Follow me on Twitter @AntonioMaio2

Saturday, June 20, 2015

Step by Step: Changing the SharePoint 2013 Farm Account Password

When setting up a new SharePoint 2013 farm, as a best practice we typically create service accounts for very specific purposes. The idea here is that we deploy SharePoint 2013 using a least privileged model, where very specific service accounts are created for very specific purposes and those accounts are only granted the permissions required to fulfill that purpose. That way, if such a service account is compromised by a malicious user, that user does not gain access to the entire farm. One such account is the SharePoint 2013 farm account.

When creating these service accounts, for various reasons, we typically create a domain account in Active Directory and configure it such that the passwords do not expire. As well, we find that the passwords for these service accounts typically are not changed often. However, there are circumstances in which the password for the SharePoint 2013 farm account must be changed.
  • One example of such a circumstance is if we suspect that the farm account has been compromised by a malicious user.
  • Another example is when consultants, such as myself, are brought in to deploy new SharePoint 2013 environments. Once that deployment process is complete and the client is happy with the environment, rightfully so, the client typically wants to take complete control of the environment and restrict farm admin level access to only a small set of internal employees - essentially they want to prevent the consultants that deployed the environment from continuing to have farm administrative level access.

Changing the SharePoint 2013 farm account is a manual process.  Its not something that is done often, so people often aren't sure which steps are required to ensure that it has been changed in all required locations.  Always be sure to test this process in a TEST SharePoint 2013 environment and monitor that environment for a period of time before performing this process in a PRODUCTION environment.  Your SharePoint 2013 farm may be configured differently that other standard configurations and your process may require extra steps.

For a standard SharePoint 2013 farm, the following are the steps required for modifying the SharePoint 2013 farm account:
1. Navigate to SharePoint 2013 Central Administration interface, click Security in the left hand menu, and click ‘Configure Managed Accounts’.  Select the farm administrators account in the account list shown, click the Edit icon and change the password.
2. Manually change the User Profile Service password.  As required by SharePoint, this service uses the farm administrator account, however SharePoint 2013 does not treat this account as a managed account so it must be changed manually. 
  • The farm administrator account must be made a local administrator on the server hosting the user profile service during the password change. 
  • Once that step is complete, launch SharePoint Central Admin, navigate to System Settings and click ‘Manage Services on Server’.  This page is used to start and stop services on each machine in the farm.  Select the machine hosting the user profile service and find that service.  It should say started. 
  • Stop the service.
  • Start the service again – when starting the script you’ll be asked for the new password
  • Ensure that you monitor the user profile service and ensure that the service starts correctly.
  • Once started, you may remove the farm administrator account as a local administrator.  However, we often recommend leaving it as a local admin on the server for simplicity of making such changes in the future.
3. Check if any applications in the Secure Store service use the farm administrator account, and if they do change the password there.
  • Launch SharePoint Central Admin, click Application Management in the left hand menu, click Manage Service Applications, click the Secure Store Application and click Manage Target Applications.
  • Select a single Target Application from the list.
  • In the Credentials group on the ribbon, click Set. This opens the Set Credentials for Secure Store Target Application dialog box.  If any target application uses the farm administrators account, change the password here. 
  • Repeat this process for all secure store applications.
  • Note: Be cautious when entering the password. If a password is entered incorrectly, no message will be displayed about the error. Instead, you'll be able to continue with configuration. However, errors can occur later, when you attempt to access data through the BCS.  If the password for the external data source is updated, you have to return to this page to manually update the password credentials.
4. Reboot all the servers in the SharePoint farm, except for SQL server.  SQL Server does not need to be restarted.

Please let me know if you have any questions or comments about this process.  There may be other services that have been configured with the farm administration account, so your process may vary somewhat, but typically the farm administrator account is reserved for specific purposes.  As a best practice, due to its high level of access, the farm administrator account should not be used widely other than for the purposes in which it was designed.



  1. This comment has been removed by a blog administrator.

  2. I've been reading up on different sites about this process and some places metion running the stsadm updatefarmcredentials and then an iisreset after going through these steps. Thoughts?

  3. Well, stsadmn may work but it was deprecated in SharePoint 2016 and we have been recommended to move off of it since SharePoint 2013 was released. So I would not recommend using it. Its still there and may very well work, but we should really stop using stsadm (and start moving to PowerShell, and unfortunately PowerShell does not have an equivalent command). As well, an IIS Reset may work, but I have always rebooted each server in the farm when making such a change. This is a fundamental change and I would be concerned about all services (windows services and SharePoint services) that rely on the farm service account credentials all getting appropriately updated at the same time. HTH

    1. Hi Antonio.

      I am new to Sharepoint, i got one project of sharepoint, where i need to install SharePoint & configure DMS (Document Management System).

      i dont have any idea about SharePoint.

      Project Details:-

      1.Installing SP
      2. Confiogure DMS
      3. Intergrate existing EMS file share storage to SP & migrate all the Data to SP.
      4. File share carrying NTFS permission should also move to SP (Is that Possible)
      please mail me the step by step for successfully completing this above project.
      my email id :-

  4. Hi Antonio,

    Great post... In our case we are using same service accounts in our content farm and shared services farm( search, UPA etc..). Can you suggest best way of changing password in these situations please..

    Many thanks in advance.

  5. This comment has been removed by a blog administrator.

    1. Have tried to reply to this a couple of times, but blogger keeps giving me issues. I would first ask where did you see this error? Is it on the Configure Managed Accounts page? I would suggest you check the farm service account in AD to see if its configured so that the password cannot be changed. You may have to perform the initial password change there. Also, I wrote an update to this post a few months later, which you can find here: Hope that helps.

  6. This comment has been removed by the author.

  7. HI,

    I need to know before changing the password at farm level, do we need to change the same at Ad and SQL level also?

  8. Will someone please tell me why Microsoft design their servers and services so that every change requires a reboot.

  9. This will allow to enter the password for the managed account. This command is the same used to set the password. You will see a screen similar to the below where you will manually enter the gmail recovery

  10. Your articles make whole sense of every topic. best password manager

    1. I am glad that I saw this post. It is informative blog for us and we need this type of blog thanks for share this blog, Keep posting such instructional blogs and I am looking forward for your future posts.
      Cyber Security Projects for Final Year

      JavaScript Training in Chennai

      Project Centers in Chennai

      JavaScript Training in Chennai

  11. Thanks for sharing nice information with us. I like your post and all you share with us is up to date and quite informative, I would like to bookmark the page so I can come here again to read you, as you have done a wonderful job.

  12. Once enact these changes in online security protocols, anyone will be able to rest easier knowing that. The World Wide Web is a safe place for use Random Password Generator Tool to do business and build friendships. Do not make the mistakes that far too many others have.


  14. I drink 2 litres of flavoured milk every day and 2 protein shakes each with 40g protein. war machines hack

  15. I drink 2 litres of flavoured milk every day and 2 protein shakes each with 40g protein. war machines hack

  16. If you have typed the wrong password, you'll receive a message that says your user name or password is incorrect. When this message appears, click OK. reset windows 10 password

  17. zombie gunship survival hack Ur editing is next level man. I hv also seen brawl stars by ea. But this is fantastic

  18. zombie gunship survival hack Ur editing is next level man. I hv also seen brawl stars by ea. But this is fantastic

  19. mini golf king hack I am a BIG FAN of getting up at 5AM. It's perfect for quiet time, CREATIVE time and connection time. I hope to make videos as GREAT as yours in the near future. (I just created my first 7 day EPIC LIFE challenge

  20. Thank you for this, definitely will try out some of these just to try getting a summer body for our August beach trip!
    war machines hack

  21. After a year, analysing all kinds of diets, finally understood that we should eat normal foods that are grown locally from our native home town... no packed or imported foods. This is the trick but nobody ill like this comment!! factory inc hack

  22. Amazing post! I appreciate your hard work. Thank you for sharing. I have also share some use full information.
    Drone pro review
    mosquitron reviews
    eco beat earphones review
    Coolair review
    Coolair air cooler review

  23. For SP2016 environment, could we simply skip the part about User Profile service? Since there is no user profile sync service in sp2016.

  24. You are the smartest, you are much louder and I hope you give me a heart zero city zombie shelter survival hack

  25. it's working fine for me! Thank you for sharing this with us dominations hack

  26. how many times i can do this ?. i used 3 times and got my di . Thnxxx war machines hack


  27. Excellent trick this great friend, this was what I was looking for a long time and finally something that works. I recommend them all if it is real is not a lie. Thanks friend. Keep it up mini golf king hack

  28. This Website is great for group chat and conversation. Thanks for sharing with us. like this website so much it's really awesome.I have also gone through your other posts too and they are also very much appreciate able and I'm just waiting for your next update to come as I like all your posts.

    The Other Track
    Radiation Stopper Pro
    Top gadgets to buy in 2020
    Q Grip Wax remover
    UV Clenizer Zoom Disinfectant robot
    X watch smartwatch
    Keysmart key oranizer

  29. Can I simply say what a comfort to find someone that genuinely understands what they are talking about on the internet. You certainly realize how to bring an issue to light and make it important. More and more people should check this out and understand this side of the story. It's surprising you aren't more popular given that you certainly have the gift.
    KBC Lottery Winner 2019 25 Lakh List
    kbc Lottery Winner 2020 List Today
    Kbc Head Office Whatsapp Number Mumbai
    KBC Lottery Number Check
    KBC Winner List 25 Lakh
    Kbc Head Office Real Number

  30. This Website is great for group chat and conversation. Thanks for sharing with us. like this website so much it's really awesome.I have also gone through your other posts too and they are also very much appreciate able and I'm just waiting for your next update to come as I like all your posts.

    Best Gadget Review
    DartleType Laser Keyboard Review
    sleepconnection anti snore review 2020

  31. Hey everyone I am so excited about this tutorial because it has helped me to I really appreciate thanks for sharing horse riding tales hack

  32. That is very helpful for increasing my knowledge in this field. hulu account generator

  33. This is really very nice post you shared, i like the post, thanks for sharing..

    Data Science Course

  34. Very awesome!!! When I seek for this I found this website at the top of all blogs in search engine.

    Data Science Training

  35. Really nice and interesting post. I was looking for this kind of information and enjoyed reading this one. Keep posting. Thanks for sharing.
    Data Science Training Institute in Bangalore

  36. I am impressed by the information that you have on this blog. It shows how well you understand this subject.
    Best Data Science Courses in Bangalore

  37. Through this post, I know that your good knowledge in playing with all the pieces was very helpful. I notify that this is the first place where I find issues I've been searching for. You have a clever yet attractive way of writing.
    Data Science Course in Bangalore

  38. Took me time to understand all of the comments, but I seriously enjoyed the write-up. It proved being really helpful to me and Im positive to all of the commenters right here! Its constantly nice when you can not only be informed, but also entertained! I am certain you had enjoyable writing this write-up.
    Data Science Training in Bangalore