3

We have automatic password change feature in SharePoint 2013. We have different managed accounts. Farm Account, application pool accounts and service accounts are created as managed accounts. Are there any consequences if we enable automatic password change settings to all these types of accounts? Or is there any recommendation that enable automatic password change settings for only certain type of accounts?

Thanks in Advance.

Improve this question

2 Answers 2

Reset to default
0

You can change the password automatically and that is working for many customers but for us it did not. There are couple of accounts which you can't update automatically i.e user profile sync account etc.

As per our experience, don't use auto password for farm admin / app pool account. Couple of things.

  • We set automatic password for app pool account, on schedule time, SharePoint change the password and trying to update the app pools(we have 10 app pools) on all servers...there is intruption and system update half app pool but fail to update remaining...so this cause the account blockage and bring all web apps down.

  • Almost Same Thing Happened with farm admin account and we spend couple of hours to fix the account.

Now we have following practice in place.

  • Schedule A Down Time.

  • Change The Password Of app pool Account At Ad.

  • Update the SharePoint with new password ( from central admin > mange accounts ).

  • Once sucessfuly updated then reset IIS on all server to make sure nothing stuck in cache.

  • Perform Testing.

  • Same Thing with farm admin account but at the end recycle SharePoint timer service...to make sure new password sync everywhere.

Improve this answer
3
  • Thanks for your comments. I understand that it is good to schedule downtime and perform password reset manually and I agree. We have service accounts that are configured to auto change password and we have not configured the farm account and application pool accounts for auto change. Since auto password change is not enabled for some managed accounts, we are daily getting a notification saying that password is expired for the farm and app pool accounts and we know password is not expired. Is there a way to stop these notifications for the accounts that we have not configured auto change?
    – Crow Canyon
    Jan 27, 2018 at 17:51
  • Where u are getting notification from SharePoint or AD or other tool? What exact message is? I don't think if there is any health rule related to this but may be.
    – Waqas Sarwar MVP ♦
    Jan 27, 2018 at 17:56
  • We have configured "Notification E-Mail Address" in "Password Management Settings" in Central Administration and we receive mail to the configured email in this setting. Message is: "The following accounts have passwords that have expired and require immediate attention" and below to this message, it is listing all the accounts that are not configured auto change password settings.
    – Crow Canyon
    Jan 27, 2018 at 18:10
0

https://blogs.msdn.microsoft.com/charliechirapuntu/2013/01/16/sharepoint-2010-service-accounts-passwords-change-guide/

Mentioned that for farm account and these accounts we should not be performing automatic password change.

Unmanaged Accounts

These are the accounts that you must perform extra steps after you have changed their password in Active Directory. The service accounts in this list are:

User Profile Synchronization Service account

User Profile Synchronization Connection account

SharePoint Server Search default content access account and Content Access accounts defined in the crawl rules.

SharePoint Foundation Search default content access account

Unattended execution accounts (Excel, Visio, PerformancePoint)

Object cache super user and object cache reader accounts

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.