3

New to the forum. I saw this post and not sure if this addresses all of my concerns. Newer Admin to a existing 2013 on-prem environment. IT has asked that all the Service Accounts for SharePoint be changed. (example: current account "SPContent_SvcAct" would be replaced by "SVC_SPContent" and so on for all the current SharePoint Service Accounts.)

IT has already created all new accounts - 'mirrored' profiles from previous existing service accounts. The new accounts will replace the exiting Service Accounts during a cut-over, and then the old ones will eventually be removed after a period of time.

I have not found anything outside of 'creating' new accounts, save for one article addressing it in for SP 2010. I'm looking to see if anyone has had to do this previously replace account to an existing environment?

  • which services accounts you are going to change? App Pool, Farm admin, Search crawl, Object cache, Profile sync account etc? could you please list all, how many accounts you are using? – Waqas Sarwar MVP Jan 22 '18 at 16:56
  • SPContent_SvcAct SPContentqua_SvcAct SPCrawler_SvcAct SPCrawlerqua_SvcAct SPFarm_SvcAct SPFarmqua_SvcAct SPServices_SvcAct SPServicesqua_SvcAct – LenJ123 Jan 22 '18 at 17:45
1

Try to do the following:

  • List all service account and the corresponding services
  • Add all the new service accounts to the managed account in central administration.
    • Central Administration > Security > Configure Managed Accounts.
  • To change application pools, go to

    • Open SharePoint Central Administration site > Operations > Service Accounts.
  • To change the farm account check this SE thread Change farm admin account in SharePoint

You can also use PowerShell to change the service accounts as mentioned at How to Change Service Accounts in SharePoint 2013 using PowerShell

Note: you can't change the Distributed cache service account from Central Administration Operations > Service Accounts, you must use the PowerShell as mentioned at Distributed Cache Service does not support this operation from Central Administration. Please use Sharepoint Powershell commandlets


For more details check

  • Okay, Thank you for your replies. So, there is no other way of chnaging Distributed Cache Service outside of PowerShell? – LenJ123 Jan 22 '18 at 17:54
  • No! you must use the PowerShell – Mohamed El-Qassas MVP Jan 22 '18 at 18:00
0

There are couple of accounts which you have to do manually.

  1. Object cache account, You cant change it from Central admin > managed accounts, What you have to do.

    • add your super user and super reader account into the Policy of Web application with proper permission then you have to run the following powershell:

      $wa = Get-SPWebApplication -Identity "" $wa.Properties["portalsuperuseraccount"] = "" $wa.Properties["portalsuperreaderaccount"] = "" $wa.Update()

Read this article for complete detail about the object cache:https://technet.microsoft.com/en-us/library/ff758656.aspx?f=255&MSPPError=-2147217396

  1. Search crawl account, You have to change it from Central admin > search service admin page.

    • add new search crawl account into policy of web application for all the web apps with full read permission.
    • change the search crawl account from the search service admin page.
  2. If you are using the User profile Sync service then

    • you have to set the permission in active directory for that account (replicate).
    • from central admin > manager service application > User profile service > click on connection > Edit...Now enter new user name and password & save and run full sync.
  3. If you have any Secure Store service then you have to update that account as well.

  4. Web application app pool account, you can change it from central admin, once you have proper permission on the databases then add that account into manageed account from central admin. After from configure Service accounts > select the app pool and change the service accounts. repeat this for all web application's app pool. followed by IIS reset.

  5. Farm admin, you have to use the stsadm command which is mentioned in Mohmmed's reply.

  6. For distributed cache, please use this script:

     $farm = Get-SPFarm $cacheService = $farm.Services | where {$_.Name -eq "AppFabricCachingService"} 
    $accnt = Get-SPManagedAccount -Identity domain_name\user_name 
    $cacheService.ProcessIdentity.CurrentIdentityType = "SpecificUser" 
    $cacheService.ProcessIdentity.ManagedAccount = $accnt 
    $cacheService.ProcessIdentity.Update() 
    $cacheService.ProcessIdentity.Deploy()
    
  • Thank you as well @Waqas - much appreciated! I will have to review in more detail and let you know if I have more questions – LenJ123 Jan 23 '18 at 18:32
  • I've also noticed in our current environment that we do not have or use 'super user and super reader accounts' - are these critical? Our farm has run without these accounts for a long time (years) – LenJ123 Jan 24 '18 at 14:49
  • if you are using publishing template or publishing feature in team site then this cache is very helpful – Waqas Sarwar MVP Jan 24 '18 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.