I have a production SharePoint farm. Now I am planning to prepare DR farm. Do you think it would be better to create new service accounts for DR or use the same ones as Production?
Both Prod and DR are connected to same AD so the accounts will be available to both of them.
What is best practice in this case?
I would recommend to use separate accounts for different environments, especially when it comes to the security aspect. A dedicated service account should only possess the minimum necessary permissions.
My answer is based upon updating passwords manually and not using SharePoint's automatic password change.
Changing service account passwords is a task that demands some time and varies based on the number of accounts and on the account's role in the farm. And it does often requires some downtime.
It might require a restart of all the servers depending on if it's a managed or unattended account that the password is changed for to make sure that all the services pick up the new password and run as normal. Remember that updating the farm accounts password need's to be done using PowerShell.
Reusing the accounts for multiple environments would require that the changes need to be done in both the environments, potentially leading to unnecessary downtime for your production environment if you would need to change any password used in the other environment.
To quote a blog-post i use when I rotate the service accounts passwords: (How to Change SharePoint 2013/2016/2019 Service Accounts Passwords). The same applies for 2013 and 2019 in my experience.
"Service accounts password change in SharePoint 2016 is a pain."
Another good guide I use is this one: SharePoint 2013: How to change all service account passwords.
