0

Some years ago I created this simple architecture:

Virtual machine A: sharepoint 2016 on premises - single server in farm

Virtual machine B: sharepoint database is MS SQL Server (Version 12.0.6433.1)

I created all accounts s with my user - so single user for everything. Sharepoint authenticates from AD.

My problem is that my user will be deleted from AD because I will quit. I guess in this case I need to change all service accounts (and other accounts) to another user. How can I do it? And what to do with the SQL Server?

Thanks in advance,

Ivanhou

2 Answers 2

3

First, you need to create at least two domain accounts, one as a farm account and one for other services!

  • List all services and application pools that run with your current account.
  • Create Domain Accounts in your AD.
  • Add the newly created accounts to managed account.
  • In SQL Server,
    • the new farm account should have db_creator and SecurityAdmin permission on the server level.
    • The service account should have an owner role on all database services.
  • Open Configure service accounts in Central Administration and assign the new service account for the farm account, application pool, services.

enter image description here

  • Also, run the below cmdlet to update farm account credentials

    stsadm -o updatefarmcredentials -userlogin DomainName\UserName -password NewPassword
    
  • Run iisreset /noforce to restart IIS

Actually, It's a risky process, so you should apply the above steps on a test environment, and next time you should follow SharePoint Service Accounts Best Practices

6
  • Thanks Mohamed! I did this in the test environment. Also removed the old service account from managed users, form all security groups of both virtual machines. Also tried to remove it in SQL Management Studio but it was refused as it was owner of databases and also cannot remove dbo user. In SQL Configuration Manager I have different users like NT Service\MSSQLSERVER so it remained unchanged. Problem is that my old user still has admin rights to newly created sitecollections. Dont know why, I removed him from everywhere and restarted both virtual machines.
    – Ivanhou
    Commented Jan 21, 2021 at 9:20
  • Now I would like to check if sharepoints authenticates from AD or it has saved passwords and even if user will be removed from AD it will be able to run with the old service account. In firewall I have blocked outgoing UDP ports:137,138,445, 88,389,53 and I can still open sitecollections with the old user after providing user/pass. Sharepoint authentication is Claims Based -> Win authentication -> NTML
    – Ivanhou
    Commented Jan 21, 2021 at 9:38
  • For the first comment, have you tried to temporarily disable it from AD, also make sure that all it actually has removed as you said! Commented Jan 22, 2021 at 7:05
  • For the second comment, how you have removed it from AD, and you still can login? Commented Jan 22, 2021 at 7:06
  • Unfortunately our department cannot do any changes to AD, so the option to disable the user is not available. When I blocked with firewall the aforementioned ports after sometime all sitecoll-s and also CentralAdmin became unreachable. I enabled again the ports and everything worked again. I dont understand why the old user still has admin rights (removed from managed accounts and from all service accounts) ?
    – Ivanhou
    Commented Jan 22, 2021 at 8:06
-2

Here're steps:

1.Create account in the AD, then add the account to the domain admins group.

2.In the SQL, grant the account as following pictures show. enter image description here enter image description here

3.You could change service accounts by using PowerShell.

https://www.sharepointdiary.com/2015/10/change-service-account-in-sharepoint-using-powershell.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.