Hot answers tagged

12

The farm account does not need to be a member of the local Administrator group. For a farm it should be a domain user, when you run the configuration wizard it will be granted the required user rights, file permissions, registry permissions, DCOM permissions, and DB permissions. When you do your initial Sync with UPS, you will need to add the farm account ...


7

in a nut shell: Managed Service Accounts. MSA’s allow you to create an account in Active Directory that is tied to a specific computer. That account has its own complex password and is maintained automatically. This means that an MSA can run services on a computer in a secure and easy to maintain manner, while maintaining the capability to ...


4

you need to create normal user accounts for the object cache accounts. They don't need to be service accounts, according to Mirjam van Olst


4

For staging environment their is no set of rules, but it is depend what staging means. Best practice is never use the production managed accounts in staging, even never share service accounts between production farms. if you share the accounts then you will risk your production farm. if accounts are used in staging and people gets the password n they ...


3

Microsoft SharePoint Server 2010 provides a number of compelling improvements designed especially for the system administrator, of these, commonly overlooked, are Managed Accounts. A Managed Account is effectively an Active Directory user account whose credentials are managed by and contained within SharePoint. In addition to storing the ...


2

Sure it does change account password. There is no need to say 'password in AD' cause there is no separate thing like 'password in SP'. As long as it's AD thing, this is subject to domain policies - complexity, expiration, uniqueness and so on. Some admins gather all SP accounts in special OU in AD, and apply no-expiry GPO. One of the finest and earliest ...


2

Answer is Yes, once you configure the Automatic password change it will update the AD as well as SharePoint( IIS etc). As per my experience and dealing with this process since launched. I highly recommend that dont configure the FarmAdmin account automatic due to following reason. If you have User Profile service configured then you know, for sync it is ...


2

Two things are absolutely critical with UPS... permissions, and doing the configuration in the right order. Spence Harbar has the 'gold standard' guide on how to setup UPS... follow it to the letter. Remember that when FIM is provisioned, it does so under the farm account, but the service should execute as another identity, and the synchronization as a ...


2

To return a list of managed accounts: Get-SPManagedAccount To create a new managed account: $appPoolUserName = "<domain>\<user_name>" $appPoolCred = Get-Credential $appPoolUserName New-SPManagedAccount -Credential $appPoolCred


1

just take a look at: https://www.windegger.wtf/sharepoint-2013-managed-accounts-2/ the post contains pretty detailed Information about createing the Managed Accounts for SharePoint 2010/2013 the first post in that series also contains a PowerShell script to create the ActiveDirectory Accounts that are used for the Managed Accounts Bye


1

You need to run the the ol school stsadm updatefarmcredentials


1

AD2012\Administrator was set as the account for the Web Application Pool 80 corresponding to the Sharepoint site. Changing it to another account in CA > Security > Configure service accounts and restarting IIS solved the problem.


1

By Default, Administrator is System Account itself. For security reason, you neither can install nor uninstall the app as a System Account. So, create a new user and assign that user a dbowner permission through SQL server management studio to app management database, SharePoint subscription setting database and the current content database where you are ...


1

I do this on a regular basis and I always use this following PowerShell: Set-SPManagedAccount -UseExistingPassword -Identity I don't usually reboot but it never hurts. For identity, use the full login name. After you hit enter, PowerShell will ask for the new password. I find this a lot quicker than using the GUI.


1

Try the following code! I had a ghost managed account that I removed this way by having the object in a variable: $account = Get-SPManagedAccount -Identity <ACCOUNT_NAME> Remoeve-SPManagedAccount -Identity $account


1

The Farm Account, which is used for the SharePoint 2010/2013 Timer service and the Central Administration site, is highly privileged and should not be used for other services on any computers in the server farm. You need to Change the Server farm account used for other services to low privileged account. This error may vary as per the services running in ...


1

For me its looks like a bad password, that's why i hate SharePoint Managed account's ability to generate new password. What i would do. Change the password of Default content Access Account( Manually change it) Update the Search adminsitration with new password Update the Account under the managed account.


1

It is most likely the account you chose at the time of Sync Connection. The page does not validate the password, it just checks that the two boxes are the same. M


1

I've been confusing 2 different, but related things. Both Active Directory and SharePoint have managed accounts. But SharePoint just refers to a normal AD account where you tell SP to auto update the password according to AD's password policy. AD means literally creating an account managed by AD without a password. You don't put an ad-managed-service ...


1

It's not required that they are managed accounts, however, if your service account passwords expire you might as well register it for password changes.


1

If this account is also a Managed Account (check in SP-CA under Security - Managed Accounts) it is possible that someone has configured the automatic password change - NEW IN SP2010. There is no way (that I know - but i'm not an expert) to find who changed a password in AD, but you can reduce to whom can change it and any way you need to turn on Auditing ...


1

A great article that might help Link


1

It is a best practice to create a specific service account per Service Application, so that the farm service account is only used for this specific purpose (health monitor will warn you if it is used for other services). With few exceptions these can each be made a managed account. Also create a service account per application pool, as this is a natural ...


1

It is SP 2010? Did you tried: Central Administration > Security > General Security > Configure service accounts > [Select One] Service Application Pool - SecurityTokenServiceApplicationPool or shortcut to it: http://[CA url]/_admin/FarmCredentialManagement.aspx


1

running SharePoint Server 2010 on Windows 7 is generally a bad idea and especially if you're using Local System and Network Service! To successfully run the User Profile Service App you need proper domain accounts. Don't waste your time to get this to work. Invest in a virtual machine (Hyper-V, VMWare, VHD boot) and run it on Windows Server with proper ...


1

You can check this on the server Start > administrator Tools > Services, Now check the SharePoint Tracing Service, Under which account this is running? You should check this on all server in farm. If the account is being used here then change it. Also try to powershell: $account = Get-SPManagedAccount -identity "domain\login" Remove-SPManagedAccount ...


1

In SharePoint 2010 it is easy. Reset the Password for SPF-ADmin account Then Go to Central Admin > Security > Managed Accounts On this Page edit the SPF-Admin account from here set the use the current password and enter the new password. click ok. It will take time( depends upon the number of server and services running under this account) Finally test it. ...



Only top voted, non community-wiki answers of a minimum length are eligible