I ran into a small nuance running 'zmcontrol stop' on my newly installed
ZCS 4.0.3.network that I thought I'd report in hopes that it gets tidied up in future releases.
I installed the mail store on one server and ldap/mta on another physical server to split the load. When running 'zmcontrol stop' on the mta box (no mail store installed there), when it gets to "Stopping mailbox..." it asks for a "Password:" three times. If I hit return 3 times it goes away and eventually the script completes. There is no harm or foul but it is annoying at best and precludes calling the script without manual intervention.
It turns out that zmcontrol is calling 'zmmailboxctl stop' which in turn calls 'zmmtaconfigctl stop', 'mysql.server stop', 'zmconvertctl stop' and 'tomcat stop'.
When 'tomcat stop' is called on a box where mailstore has not been installed, it asks for a password because the 'tomcat' script tries to sudo 'libexec/zmtomcatmgr' which is not handled in /etc/sudoers.
The simple fix to eliminate this nuisance is just to add:
%zimbra ALL=NOPASSWD:/opt/zimbra/libexec/zmtomcatmgr
to /etc/sudoers on the box without the mailstore component installed.
I'm posting this to bring it to the attention of the Zimbra engineers so that they can possibly come up with a more elegant solution in subsequent releases, e.g. dynamically determining the 'allservices' array in zmcontrol and not calling stop for services that don't exist on the calling server.
My guess is this is isn't their highest priority outstanding "issue", however.
Bugzilla
Wiki
Source
"zmcontrol stop" asks for Password: 
Linear Mode
