The question seems straight-forward, but my scenario actually isn't due to circumstances.

I'm using SharePoint 2013 in a Farm setup. I'm getting this error from Central Administraton --> Security --> Configure Service Accounts.

"Some or all identity references could not be translated. "

This is because the domain account that one of our managed users exists as was deleted before reassigning the Farm Component, Service Applications, and IIS Application Pools used by this account.

This user is assigned to the Farm Components:

Distributed Cache Application Discovery and Load Balancer Service Applications

I can see this by viewing the managed account.

I've researched the crud out of this and was eventually able to reassign the Distributed Cache to another managed user via the script here: http://www.askaboutasp.net/_-_128_How_to_replace_a_SharePoint_managed_account_using_PowerShell_3f.aspx

I've also reassigned application pool identities to another account. I am not able to reassign the Application Discovery and Load Balancer Service Applications to another account, however. I can view the Service Applications from Central Administration, but when I highlight this one, the Manage, Administrators, and Properties links are disabled. The New, Connect, Delete, Publish, and Permissions links are enabled, though.

I'm logged on as a domain administrator.

Anyone have any thoughts on how to resolve this?

  • 1
    Have you tried to go central admin>security > configure service account page....select the application load balancer and try to change it with different account – Waqas Sarwar MVP Jul 6 '16 at 0:09
  • As I stated in my question, I had tried that, but it the "Some or all identity references could not be translated. "error occurs. – jason Jul 6 '16 at 13:53
  • Under which account the App load balance is ruuning, what i understand, it should run under farm account? did you mess up the farm account? – Waqas Sarwar MVP Jul 6 '16 at 13:57
  • I don't think it was the farm account. It had to be a user account as they left the company and the AD account was deleted. So, yes, this was most likely setup wrong to begin with by the former SharePoint Administrator. – jason Jul 6 '16 at 14:05
  • could you please check what is farm account? also another thing you can do, stop the App load service instance and then run the remove- command with force on the account – Waqas Sarwar MVP Jul 6 '16 at 14:06

Typically, it runs under the farm account but if you changed it then the possible workaround is.

  • Stop the Application Discovery and Load Balancer Service Application Service's Instance
  • Remove the Service Faulty service account using the powershell "Remove-SPManagedAccount -Identity "

Now you can start the service instance, i think it will pick the Farm account. But if not you can go

  • Central admin > Security > Configure service accounts
  • On this page Select " Service Application pool -SharePoint Web Services System" and from the account dropdown select Farm account
  • Thanks for your help so far @Waqas Sarwar MCSE. Network just reenabled the deleted domain account. I'm still having the same issues with reassigning the service and deleting the managed account. It's a heck of a catch 22. – jason Jul 6 '16 at 15:51

I really want to accept @Waqas answer as that answer and the very long discussion in the comments are things that should have worked. But, ultimately, they didn't.

I was able get the id and stop the Application Discovery and Load Balancer Service Application by running:

Get-SPServiceInstance -all | out-file c:\servicelistall.txt


stop-spserviceinstance <id as located from output in previous command>

I had to run this on each server in our farm. Despite this, when I tried:

remove-SPManagedAccount -Identity <domain\networkid>

I got an error that said a user by that name could not be found. This annoyed the tar out of me because running gET-SPManagedAccountclearly showed the managed account.

As I had thought all along, we had really shot ourselves in the foot by 1) using a user account in the farm in the first place 2) deleting said domain account before reassigning it's responsibilities. Oops. Yay!

Given that all of the user facing options SharePoint exposes either through Central Administration or through PowerShell had failed, I was left with only one option that I saw: locate the managed account in the config database and update the record.

I found the managed users via:

  SELECT TOP 10000 [Id]
  FROM [SharePoint_Config].[dbo].[Objects]
  where len(name) > 0 and name is not null
  and name like '%managed%'

From here I was able to locate the specific records via:

  SELECT TOP 10000 [Id]
  FROM [SharePoint_Config].[dbo].[Objects]
  where len(name) > 0 and name is not null
  and name like '%managed%'
  and properties like '%<domain account here>%'

The solution at this point can go a couple of ways but they all amount to updating the target record in the objects table with an m_SID (note that this is a field in the xml of the properties value) value that exists in AD. In our case, we recreated the missing account, but that didn't work because the m_SID value didn't match the one in SharePoint.

After getting the m_SID for the new account, I did an update on the name & properties fields.

After that everything worked fine in SharePoint. I was able to go Central Administration --> Security --> Configure Service Accounts (remember this page bombed before hand) and reassign the Application Discovery and Load Balancer Service Application to the farm account and subsequently delete the managed account that was no longer used.

I have spent a number of days trying to resolve this. Thank you, Waqas Sarwar MCSE, for helping me exhaust all the SharePoint & PowerShell options I didn't know existed.

Lastly, I really want to point the reader to: Replace a managed account in SharePoint. This script was magnificent resource and aided me in replacing this account in other places. For whatever reason, it was not picking up the Application Discovery and Load Balancer Service Application service, even after adding the -all flag to the Get-SPServiceInstance calls. As with any script you didn't write yourself, read it over, understand what it does, and probably comment out the bits that actually change stuff so you can see what all would be changed via the Write-Host outputs (may need to add some as needed).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.