diff --git a/hooks/nova_cc_hooks.py b/hooks/nova_cc_hooks.py
index 377191b3..90ff8e08 100755
--- a/hooks/nova_cc_hooks.py
+++ b/hooks/nova_cc_hooks.py
@@ -289,7 +289,8 @@ def config_changed():
         ncc_utils.set_shared_metadatasecret()
     for rid in hookenv.relation_ids('ha'):
         ha_joined(rid)
-    if not ch_utils.is_unit_paused_set():
+    if (not ch_utils.is_unit_paused_set() and
+            ncc_utils.is_console_auth_enabled()):
         ch_host.service_resume('nova-consoleauth')
 
 
diff --git a/hooks/nova_cc_utils.py b/hooks/nova_cc_utils.py
index 0b8260fa..b97cf4c5 100644
--- a/hooks/nova_cc_utils.py
+++ b/hooks/nova_cc_utils.py
@@ -273,7 +273,7 @@ def resource_map(actual_services=True):
         _resource_map[NOVA_CONF]['services'] += (
             common.console_attributes('services'))
 
-    if (hookenv.config('enable-serial-console') and cmp_os_release >= 'juno'):
+    if is_serial_console_enabled(cmp_os_release):
         _resource_map[NOVA_CONF]['services'] += SERIAL_CONSOLE['services']
 
     # also manage any configs that are being updated by subordinates.
@@ -390,7 +390,7 @@ def determine_packages():
         pass
     if common.console_attributes('packages'):
         packages.extend(common.console_attributes('packages'))
-    if (hookenv.config('enable-serial-console') and release >= 'juno'):
+    if is_serial_console_enabled(release):
         packages.extend(SERIAL_CONSOLE['packages'])
     packages.extend(
         ch_utils.token_cache_pkgs(source=hookenv.config('openstack-origin')))
@@ -523,6 +523,31 @@ def disable_policy_rcd():
     os.unlink('/usr/sbin/policy-rc.d')
 
 
+def is_serial_console_enabled(cmp_os_release=None):
+    """Determine whether serial console is enabled in this deploy
+
+    :param cmp_os_release: Release comparison object.
+    :type cmp_os_release: charmhelpers.contrib.openstack.utils.
+                          CompareOpenStackReleases
+    :returns: Whether serial console is enabled in this deploy
+    :rtype: bool
+    """
+    if not cmp_os_release:
+        release = ch_utils.os_release('nova-common')
+        cmp_os_release = ch_utils.CompareOpenStackReleases(release)
+    return hookenv.config('enable-serial-console') and cmp_os_release >= 'juno'
+
+
+def is_console_auth_enabled():
+    """Determine whether console auth is enabled in this deploy
+
+    :returns: Whether console auth is enabled in this deploy
+    :rtype: bool
+    """
+    return bool(is_serial_console_enabled() or
+                hookenv.config('console-access-protocol'))
+
+
 def is_db_initialised():
     if hookenv.relation_ids('cluster'):
         dbsync_state = ch_peerstorage.peer_retrieve('dbsync_state')
diff --git a/unit_tests/test_nova_cc_utils.py b/unit_tests/test_nova_cc_utils.py
index 7354184f..af5938b8 100644
--- a/unit_tests/test_nova_cc_utils.py
+++ b/unit_tests/test_nova_cc_utils.py
@@ -1383,6 +1383,48 @@ class NovaCCUtilsTests(CharmTestCase):
         with self.assertRaises(Exception):
             utils.archive_deleted_rows()
 
+    def test_is_serial_console_enabled_on_juno(self):
+        self.os_release.return_value = 'juno'
+        self.test_config.set('enable-serial-console', True)
+        self.assertTrue(
+            utils.is_serial_console_enabled())
+
+    def test_is_serial_console_enabled_off_juno(self):
+        self.os_release.return_value = 'juno'
+        self.test_config.set('enable-serial-console', False)
+        self.assertFalse(
+            utils.is_serial_console_enabled())
+
+    def test_is_serial_console_enabled_on_icehouse(self):
+        self.os_release.return_value = 'icehouse'
+        self.test_config.set('enable-serial-console', True)
+        self.assertFalse(
+            utils.is_serial_console_enabled())
+
+    @patch.object(utils, 'is_serial_console_enabled')
+    def test_is_console_auth_enabled(self, is_serial_console_enabled):
+        is_serial_console_enabled.return_value = True
+        self.test_config.set('console-access-protocol', 'vnc')
+        self.assertTrue(
+            utils.is_console_auth_enabled())
+
+    @patch.object(utils, 'is_serial_console_enabled')
+    def test_is_console_auth_enabled_no_serial(self,
+                                               is_serial_console_enabled):
+        is_serial_console_enabled.return_value = False
+        self.test_config.set('console-access-protocol', 'vnc')
+        self.assertTrue(
+            utils.is_console_auth_enabled())
+
+    @patch.object(utils, 'is_serial_console_enabled')
+    def test_is_console_auth_enabled_no_serial_no_console(
+            self,
+            is_serial_console_enabled):
+        is_serial_console_enabled.return_value = False
+        self.test_config.set('console-access-protocol', None)
+        self.assertFalse(
+            utils.is_console_auth_enabled())
+
     @patch.object(utils, 'get_cell_uuid')
     @patch('subprocess.check_output')
     def test_add_hosts_to_cell(self, mock_check_output, mock_get_cell_uuid):