Is there a way to change the WF farm's admin group from "builtin\administrators" to another group once Workflow Manager is installed?

Just to be clear, this command supposedly does this but it does not seem to actually do what is claimed.

$sec = New-Object Microsoft.Workflow.Client.Security.WindowsSecurityConfiguration("All Users")
$sec.WorkflowAdminGroupName = "Users"
  • what error you are getting? did you provide a valid Windows Domain group? – Waqas Sarwar MVP Jul 31 '14 at 22:07
  • That was the problem, WF Manager was installed with the default group BUILTIN\administrators which will not work in a multi-server deployment. I have since left the WFM farm and created a new one. But I have read that changing the value is possible but could not find a method that actually persisted the change. At this point it's more of an exercise in curiosity and knowing what's possible with the system. – Robert Kaucher Aug 1 '14 at 14:18

I know this is a bit old, but I figured this can be helpful for other people that may run across this post.

I resolved the issue by using the WFFarm and SBFarm PowerShell commands. Be sure to run this from the account that has elevated privileges on the SQL Databases (usually the farm account):

$WF = Get-WFFarm ##Current WF Config

$WF.AdminGroup = "domain\username" ##Update the admin group

$WF ##output new config

$SB = Get-SBFarm ##Output current Service Bus config

Stop-SBFarm ##Need to stop the Service Bus farm before updating

Set-SBFarm -AdminGroup "domain\username" ##Update to the new admin group

Update-SBHost ##Update the Service Bus Host with new information

Start-SBFarm ##Start the Service Bus Farm. This can take a while.

$SB ##Output new Service Bus settings

You can also confirm the change in SQL Management Studio as well by pulling up the properties of the SB and WF DBs and looking at the Permissions screen. I hope that helps!


The answer above may work for Service Bus 1.1, but I don't believe that Service Bus 1.0 has the Set-SBFarm cmdlet.

Service Bus 1.0 may be old, but it's still out there. I recently had a colleague do an install and he forgot to change the administrators group which then defaulted to BUILTIN\Administrators. Rather than uninstall and reinstall, I decided to change the group manually.

I found that if you change the values in the database directly, you can make the change. The tables that have the administrator group are:

SBManagementDB Store.Clusters

WFManagementDB Store.Clusters

and WFResourceManagementDB Scopes has a SecuritySettings column with XML, if you replace the XML with something like this, it should work:

    <ScopeInfo.ScopedSecurityConfigurationCollection xmlns="http://schemas.microsoft.com/workflow/2012/xaml/activities" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><ScopedSecurityConfiguration i:type="WindowsSecurityConfiguration"><Name>Microsoft.Workflow.Management.Security.WindowsSecurityConfiguration</Name><WorkflowAdminGroupName>{Your Admin Group Here}</WorkflowAdminGroupName></ScopedSecurityConfiguration></ScopeInfo.ScopedSecurityConfigurationCollection>

Your results may vary, this solution worked for me and it was much easier than the reinstall.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.