I’d been meaning to post this for quite some time but just haven’t gotten around to it – as paranoid administrators we often find the need to change our service account passwords and doing so with a product like SharePoint can be a rather significant effort if you consider all the various accounts that may be used in a least privileges model. If you’re just about to make hit this situation you’re likely to do a quick search and find the following support article: http://support.microsoft.com/kb/934838 – this article provides you with the stsadm commands you need as well as a sample script that you can use.

The problem I have is that the article doesn’t provide a complete script – the sample only addresses some SSP related settings and app pools – it makes mention of the commands needed to change the farm account but it doesn’t include those commands in the script. It also has a line where you have to go and manually make a change via the browser – this is because the out of the box stsadm commands don’t provide you with all the stuff you need to change all the passwords. Specifically there’s two missing – the default content access account and the user profile import account. Seeing as I consider myself a developer and not an administrator (though sometimes I wonder) I decided to build those missing commands which I’ve previously blogged about here and here.

Using these two commands I created the script shown below – note that you don’t necessarily need all the execadmsvcjobs calls but I prefer to make sure that all pending jobs complete before moving onto the next step. Also – you may not have as many accounts – you can either remove the unnecessary lines and/or change the variable values as needed but I’d encourage you to leave the variable names so that it is clearer what each account is used for. Of course this batch file will not actually make the password changes – if you need a script that will actually make the password change then look here. And finally – please, please, please do NOT leave this script on your server when you are done – it’s a huge security risk storing all the passwords in a script like this so you need to make sure that you either store the file in a secure location and/or blank the passwords out when not being utilized.

As always – if you have any comments or suggestions please let me know as I’m always looking for ways to improve and I’m by now means a batch file expert.

  1@echo off
  2
  3SET PATH=C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN;%PATH%
  4SET DOMAIN=spdev
  5SET SSP=SSP1
  6
  7rem *** Farm account (central admin app pool, timer jobs account)
  8set APP_POOL_CA_USER="%DOMAIN%\spfarm"
  9set APP_POOL_CA_PWD="pa$$w0rd"
 10
 11rem *** SharePoint SSP Service Account
 12set SSPSVC_USER="%DOMAIN%\sspsvc"
 13set SSPSVC_PWD="pa$$w0rd"
 14
 15rem *** SharePoint SSP Application Pool Account
 16SET APP_POOL_SSP_USER="%DOMAIN%\sspapppool"
 17SET APP_POOL_SSP_PWD="pa$$w0rd"
 18
 19rem *** SharePoint Server Search Service Account 
 20set SEARCH_USER="%DOMAIN%\sspsearch"
 21set SEARCH_PWD="pa$$w0rd"
 22
 23rem *** SharePoint Services Help Search Service Account 
 24set SEARCH_HELP_USER="%DOMAIN%\sphelpsearch"
 25set SEARCH_HELP_PWD="pa$$w0rd"
 26
 27rem *** Default content access account for office search
 28set CONTENT_USER="%DOMAIN%\sspcontent"
 29set CONTENT_PWD="pa$$w0rd"
 30
 31rem *** content access account for windows sharepoint services help search
 32set CONTENT_HELP_USER="%DOMAIN%\spcontentsearch"
 33set CONTENT_HELP_PWD="pa$$w0rd"
 34
 35rem *** User profile import account
 36set PROFILE_IMPORT_USER="%DOMAIN%\sspuserprofilesvc"
 37set PROFILE_IMPORT_PWD="pa$$w0rd"
 38
 39rem *** Portal application pool account
 40set APP_POOL_PORTAL_USER="%DOMAIN%\spportalapppool"
 41set APP_POOL_PORTAL_PWD="pa$$w0rd"
 42
 43rem *** Teams sites application pool account
 44set APP_POOL_TEAMS_USER="%DOMAIN%\spcollabapppool"
 45set APP_POOL_TEAMS_PWD="pa$$w0rd"
 46
 47rem *** My sites application pool account
 48set APP_POOL_MYSITE_USER="%DOMAIN%\spmysitesapppool"
 49set APP_POOL_MYSITE_PWD="pa$$w0rd"
 50
 51rem *** Excel Services Unattended User Account
 52set SVC_EXCEL_USER="%DOMAIN%\SPSSAcct_dev"
 53set SVC_EXCEL_PWD="Pa$$w0rd"
 54
 55goto startpoint
 56:startpoint
 57
 58
 59rem central admin
 60ECHO %DATE% %TIME%: Updating Central Admin password
 61stsadm -o updatefarmcredentials -userlogin %APP_POOL_CA_USER% -password %APP_POOL_CA_PWD% -identitytype configurableid
 62if not errorlevel 0 goto errhnd
 63
 64ECHO %DATE% %TIME%: Executing pending timer jobs
 65stsadm -o execadmsvcjobs
 66if not errorlevel 0 goto errhnd
 67
 68ECHO %DATE% %TIME%: Run "stsadm -o updatefarmcredentials -userlogin %APP_POOL_CA_USER% -password %APP_POOL_CA_PWD% -identitytype configurableid -local" on each WFE before continuing
 69pause
 70ECHO %DATE% %TIME%: Run "stsadm -o execadmsvcjobs" on each WFE before continuing.
 71pause
 72
 73iisreset /noforce
 74
 75rem application pools
 76ECHO %DATE% %TIME%: Updating app pool passwords for Portal
 77stsadm -o updateaccountpassword -userlogin %APP_POOL_PORTAL_USER% -password %APP_POOL_PORTAL_PWD% -noadmin
 78if not errorlevel 0 goto errhnd
 79
 80ECHO %DATE% %TIME%: Executing pending timer jobs
 81stsadm -o execadmsvcjobs
 82if not errorlevel 0 goto errhnd
 83
 84ECHO %DATE% %TIME%: Updating app pool passwords for Teams
 85stsadm -o updateaccountpassword -userlogin %APP_POOL_TEAMS_USER% -password %APP_POOL_TEAMS_PWD% -noadmin
 86if not errorlevel 0 goto errhnd
 87
 88ECHO %DATE% %TIME%: Executing pending timer jobs
 89stsadm -o execadmsvcjobs
 90if not errorlevel 0 goto errhnd
 91
 92ECHO %DATE% %TIME%: Updating app pool passwords for MySite
 93stsadm -o updateaccountpassword -userlogin %APP_POOL_MYSITE_USER% -password %APP_POOL_MYSITE_PWD% -noadmin
 94if not errorlevel 0 goto errhnd
 95
 96ECHO %DATE% %TIME%: Executing pending timer jobs
 97stsadm -o execadmsvcjobs
 98if not errorlevel 0 goto errhnd
 99
100ECHO %DATE% %TIME%: Updating app pool passwords for SSP
101stsadm -o updateaccountpassword -userlogin %APP_POOL_SSP_USER% -password %APP_POOL_SSP_PWD% -noadmin
102if not errorlevel 0 goto errhnd
103
104ECHO %DATE% %TIME%: Executing pending timer jobs
105stsadm -o execadmsvcjobs
106if not errorlevel 0 goto errhnd
107
108
109rem ssp - new
110ECHO %DATE% %TIME%: Updating ssp password for new installs
111stsadm -o editssp -title %SSP% -ssplogin %SSPSVC_USER% -ssppassword %SSPSVC_PWD%
112if not errorlevel 0 goto errhnd
113
114ECHO %DATE% %TIME%: Executing pending timer jobs
115stsadm -o execadmsvcjobs
116if not errorlevel 0 goto errhnd
117
118ECHO %DATE% %TIME%: Executing pending timer jobs
119stsadm -o execadmsvcjobs
120if not errorlevel 0 goto errhnd
121
122
123rem osearch
124ECHO %DATE% %TIME%: Updating osearch password
125stsadm -o osearch -farmserviceaccount %SEARCH_USER% -farmservicepassword %SEARCH_PWD%
126if not errorlevel 0 goto errhnd
127
128ECHO %DATE% %TIME%: Executing pending timer jobs
129stsadm -o execadmsvcjobs
130if not errorlevel 0 goto errhnd
131
132ECHO %DATE% %TIME%: Updating default content access account
133stsadm -o gl-updatedefaultcontentaccessaccount -username %CONTENT_USER% -password %CONTENT_PWD%
134if not errorlevel 0 goto errhnd
135
136ECHO %DATE% %TIME%: Executing pending timer jobs
137stsadm -o execadmsvcjobs
138if not errorlevel 0 goto errhnd
139
140iisreset /noforce
141
142rem spsearch
143ECHO %DATE% %TIME%: Updating spsearch password
144stsadm -o spsearch -farmserviceaccount %SEARCH_HELP_USER% -farmservicepassword %SEARCH_HELP_PWD%
145if not errorlevel 0 goto errhnd
146
147ECHO %DATE% %TIME%: Executing pending timer jobs
148stsadm -o execadmsvcjobs
149if not errorlevel 0 goto errhnd
150
151ECHO %DATE% %TIME%: Updating spsearch content access account
152stsadm -o spsearch -farmcontentaccessaccount %CONTENT_HELP_USER% -farmcontentaccesspassword %CONTENT_HELP_PWD%
153if not errorlevel 0 goto errhnd
154
155ECHO %DATE% %TIME%: Executing pending timer jobs
156stsadm -o execadmsvcjobs
157if not errorlevel 0 goto errhnd
158
159ECHO %DATE% %TIME%: Updating default profile import account
160stsadm -o gl-setuserprofiledefaultaccessaccount -username %PROFILE_IMPORT_USER% -password %PROFILE_IMPORT_PWD% -sspname %SSP%
161if not errorlevel 0 goto errhnd
162
163ECHO %DATE% %TIME%: Executing pending timer jobs
164stsadm -o execadmsvcjobs
165if not errorlevel 0 goto errhnd
166
167ECHO %DATE% %TIME%: Updating excel services unattended service account
168stsadm -o set-ecsexternaldata -ssp %SSP% -unattendedserviceaccountname %SVC_EXCEL_USER% -unattendedserviceaccountpassword %SVC_EXCEL_PWD%
169if not errorlevel 0 goto errhnd
170
171ECHO %DATE% %TIME%: Executing pending timer jobs
172stsadm -o execadmsvcjobs
173if not errorlevel 0 goto errhnd
174
175rem restarting IIS
176ECHO %DATE% %TIME%: Doing soft restart of IIS
177
178iisreset /noforce
179echo on
180goto end
181
182:errhnd
183
184echo An error occured - terminating script.
185
186:end

To use this script on WSS just remove the unnecessary elements (lines with the following commands: gl-setuserprofiledefaultaccessaccount, gl-updatedefaultcontentaccessaccount, editssp, osearch, and set-ecsexternaldata).