Starting with CCM 3.3.2 you should NOT manually change service account passwords. See cut below from Readme of Cisco CallManager 3.3(2) Admin Password Utility. FYI I did not find the app on the CCM I was having issues installing rather I found on a CCM running 3.3.2spC. Only on Pub. Look on your PUB, TAC probably can send or allow special download access if needed.
I have posted parts of the readme, serious caveats to acknowledge and follow:
Important NOTES:
The Cisco CallManager 3.3(2) has been modified to increase the security for the NT Services that comprise the system. Many of the services that were running as Local System in prior releases have been changed to run as Local NT User accounts/services. These accounts are: CCMServiceRW, CCMService, CCMEML, CCMCDR, CCMUser, SQLSVC, and BackAdmin. During installation, by default, an account is created (without “Log on locally” access) and the local NT password is set using a 128-bit encryption algorithm that creates a unique 15-character password for each account within the Cisco CallManager cluster. The passwords generated meet all four classes of the Microsoft complex password rules which state that passwords must contain characters from at least three of the following four classes: at least 6-characters in length that contains English lower-case letters, English upper-case letters, Westernized Arabic Numerals, and Non-alphanumeric ("special characters").
Due to the complexity of the interoperability relationships of the Cisco CallManager, we strongly recommend Administrators/Installers NOT change any CallManager passwords/services manually. If you decide to change these passwords, the Cisco-provided AdminUtility.exe should be used with the following caveats:
o After using the AdminUtility.exe to change passwords from defaults if for any reason you need to ADD or REPLACE a Subscriber system you MUST reset the passwords for all accounts/services back to default system generated ones before attempting the install otherwise the Subscriber installation will fail.
o The local Administrator account passwords must be identical for every Cisco CallManager system within the cluster. Always log on with the local Administrator account to run the AdminUtility.exe utility.
o The AdminUtility.exe is located in the C:\Program Files\Cisco\Bin directory and must be run using the local Administrator account on the Publisher server. It cannot be successfully executed on Subscriber servers.
o The Publisher must be configured using the default DNS name for the system within the Cisco CallManager Administration Server Configuration web page. If the system is configured to use the IP address you will receive the following error message: “You can only execute this utility on the Publisher!” To correct this go to the Cisco CallManager Administration web page, from the menu go to System/Server. Click on the Publisher within the list on the left-hand list. Change the Publisher DNS/IP Address setting from IP Address to DNS name. Click Update. Re-run the AdminUtility.exe utility.
o All systems that constitute the Cisco CallManager cluster should be in a single identical Workgroup, not a Windows NT or Active Directory Domain. AdminUtility.exe is unable to successfully synchronize CallManager passwords/services in a mixed workgroup/domain environment. If this occurs, configure the Subscriber into the same Workgroup as the Publisher and re-run the utility.
o Local Security Account Policies for these accounts cannot not Enforce Password History, Maximum Password Age, Minimum Password Age, and Account Lockout.
