2

Does changing password through Central Administration for any managed account (like my farm admin account) also sync and update the password in AD? If we change password for a managed account in AD then definitely we need to update the same password in Central Admin for that managed account. But what happens in case when we directly create a new password in Central Admin for a managed account? Does this updates the password in AD?

enter image description here

What if SharePoint Administrator sets Enable automatic password change on the Configure Managed Accounts page in Central Admin? Also this option updates the managed account password in AD automatically?

enter image description here

Improve this question

2 Answers 2

Reset to default
2

Answer is Yes, once you configure the Automatic password change it will update the AD as well as SharePoint( IIS etc).

As per my experience and dealing with this process since launched. I highly recommend that dont configure the FarmAdmin account automatic due to following reason.

  1. If you have User Profile service configured then you know, for sync it is using the farm admin account. their is no way in SharePoint managed password that update password for sync connection. So, SharePoint on a day change the password for Farm admin and then you sync will stop working.enter image description here
  2. Farm admin account used in different services, i.e central admin app pool, timer service, admin service etc on all server in the farm. If anything happen during the password change( if you have multiple server farm) like network glitchs, timer service stop etc then this change will not go throw and now you will be in trouble.

App Pools accounts are ok, but farm admin should not be automatic as per my experince but if you have single server farm then fine.

http://blogs.msdn.com/b/charliechirapuntu/archive/2013/01/18/10385512.aspx

Improve this answer
1
  • what exactly you mean by if you have a single server farm then fine?
    – Zakir HC
    Feb 26, 2016 at 18:03
2

Sure it does change account password. There is no need to say 'password in AD' cause there is no separate thing like 'password in SP'. As long as it's AD thing, this is subject to domain policies - complexity, expiration, uniqueness and so on. Some admins gather all SP accounts in special OU in AD, and apply no-expiry GPO.

One of the finest and earliest articles about this feature I've seen is http://blogs.technet.com/b/seanearp/archive/2011/01/25/updating-passwords-on-sharepoint-2010.aspx - might be useful

Improve this answer
6
  • By your answer I understand that, yes creating a new password in CA also updates the password in AD. What if we Enable automatic password change in CA? Does this also updates the password in AD? Then what about IIS application pools that are using this password? Does it also automatically change for them?
    – Zakir HC
    Feb 23, 2016 at 7:48
  • 1
    Yes, changing a password thru CA or Powershell changes the password in AD and all servers in farm. You can change any managed account - IIS pool identity, search services&accounts, even the farm service itself (CA & timer pool). When you enable automatic change, SP will change password to newly generated strong one on schedule. Here's the documentation: technet.microsoft.com/en-us/library/ff724278.aspx
    – Aziz Kabyshev
    Feb 23, 2016 at 8:04
  • Quote: When SharePoint 2013 changes the credentials for a managed account, the credential change process will occur on one server in the farm. Each server in the farm will be notified that the credentials are about to change and servers can perform critical pre-change actions, if they are necessary. If the account password has not yet been changed, then SharePoint 2013 will attempt to change the password using either a manually entered password, or a long, cryptographically-strong random string
    – Aziz Kabyshev
    Feb 23, 2016 at 8:07
  • Are your sure that enabling automatic password change will also update password in IIS application pools? I am making things clear coz later I don't want to run in problem.
    – Zakir HC
    Feb 23, 2016 at 8:12
  • Yes. Pool identity is managed account. See blogs.msdn.com/b/charliechirapuntu/archive/2013/01/16/… . Quote: Managed Accounts. These are the accounts that you can just use the "Configure managed accounts" page in SharePoint 2010 Central Administration to change the password and be done. I normally don't even need to know the passwords of these accounts. I also set automatic password change for these accounts. ... The accounts in this group are: Web application pool service account(s) ...
    – Aziz Kabyshev
    Feb 23, 2016 at 8:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.