BigFix / ILMT Upgrade Case Summary and Pre-Upgrade Recommendation

Why is this useful?

This enhancement would prevent a common and difficult-to-identify failure during BigFix and ILMT upgrades in environments using a remote SQL Server with Windows Authentication.

In this case, the pre-upgrade Fixlet failed because some BigFix-related services were running under a local system/user account while others were running under the approved service account. The logs showed only a SQL login failure for the machine account and did not clearly indicate that inconsistent service logon accounts were the underlying cause.

By detecting this before the upgrade starts, the enhancement would reduce failed Fixlet executions, avoid unnecessary troubleshooting, minimize upgrade delays, and improve confidence in the upgrade process.

Who will benefit?

This will benefit:

BigFix and ILMT administrators performing version upgrades.

Windows and SQL Server administrators supporting BigFix environments.

IBM Support teams handling upgrade and authentication-related cases.

Customers using remote SQL Server databases with Windows Authentication.

Implementation partners and managed-service teams responsible for upgrade readiness.

How should it work?

The BigFix pre-upgrade Fixlet should include an automated Service Account and Remote SQL Authentication Pre-Check.

Before allowing the upgrade to proceed, the Fixlet should:

Detect and display the logon account configured for all relevant BigFix services, including BES Server components and BES Client.

Identify inconsistent configurations, such as services running under Local System/local user while other required services use a domain service account.

Clearly show the Windows identity that will be presented to the remote SQL Server during the Fixlet execution.

Warn the administrator when Local System will cause the BigFix server machine account to be used for database authentication.

Validate that the account used for the upgrade has the required permissions on the BFEnterprise and BESReporting databases.

Explain that credentials entered in the Fixlet may not override Windows Authentication when the Fixlet runs under the BES Client service context.

Provide clear pre-upgrade guidance to correct the service-account configuration and record the original configuration.

Remind administrators to restore any temporarily changed service account after the upgrade, where required by the standard BigFix configuration.

This capability would provide clear direction before the Fixlet runs, instead of relying on unclear SQL authentication errors after failure.