PowerShell Script for Updating the Password for SharePoint On Premise Service Accounts

 Here's a useful script for updating SharePoint Service Account passwords.  

SharePoint actually has a useful ManagedAccounts system where it will automatically change the password for the account.  However, on one of my SharePoint farms, it doesn't quite work right.  

For some reason, after the automatic password change, some of the services or app pools never receive the new password.

So, I have had to change the password manually and make sure the services and app pools have the correct password.

The following script will change the service account password, and then update the app pools and services on the server it is running on.  

The service accounts are  specified in the $serviceAccounts variable.  You will need to edit the script and set those accounts to the ones on your farm.  

You will need the ActiveDirectory Module | Microsoft Docs ,the WebAdministration module, and the Microsoft.SharePoint.Powershell snap in.

NOTE: This script was written for a single WFE SharePoint farm.  

If you have more than one server in your SharePoint farm, you would need to modify this script to change the password only once, and then update the app pools and services for each web or application server in your farm.

Also, recommend testing this script in a dev environment and confirming it works first.  Next, running this script may cause an interruption of service as services must be restarted after running.   If you are in a high availability environment, schedule an authorized maintenance period to reset your service account passwords first.   

Noticed that sometimes some services or app pools may not restart successfully immediately after the password is updated, and I had to restart some of the services manually after running the script.  

Disclaimer: This script is provided free to the community as is with no warranty, guarantee, or financial responsibility from the author.  You are free to use and modify this script, as well as use the script for sample code in your own scripts.  As with any scripts, you run them at your own risk and should review the code, and if available, test the script in a development environment before running them.

#Thanks to the following web sites for sample code which helped me write this script

#Author: Will Chung, Script Created: 2020-12-10

#https://www.sharepointpals.com/post/powershell-script-to-change-password-for-app-pool-and-manage-account-in-sharepoint-onprem-server/

#https://blog.techinline.com/2018/12/20/how-to-change-windows-password-using-command-line-or-powershell/

#https://gallery.technet.microsoft.com/scriptcenter/powershell-script-to-find-6fc15ecb

#https://gallery.technet.microsoft.com/scriptcenter/79644be9-b5e1-4d9e-9cb5-eab1ad866eaf

Add-PSSnapin "Microsoft.SharePoint.PowerShell";

Import-Module WebAdministration;

Import-Module ActiveDirectory;

$serviceAccounts="DOMAIN\SP.service","DOMAIN\SP.farm";

foreach ($username in $serviceAccounts)

{

$newpassword = Read-Host ("Enter in new password for: " + $username);

$newpasswordSS = ConvertTo-SecureString $newpassword -AsPlainText -Force;

$usernameonly =$username;

if ($usernameonly.Contains("\"))

{

    $usernameOnly = $username.Substring($username.IndexOf("\")+1);

}

Write-Host "Changing the password for $($usernameOnly):";

try

{

Set-ADAccountPassword -Identity $usernameonly -Reset -NewPassword $newpasswordSS -ErrorACtion Stop;

}

catch 

{

 Write-Output ("Error changing password: " + $_);

 exit;

}

Write-Host "Updating application pools with process identity of $($username)...";

 $applicationPools = Get-ChildItem IIS:\AppPools | where { $_.processModel.userName -eq $username }

  

 foreach($pool in $applicationPools)

 {

     Write-Host ("    Updated app pool " + $pool.Name);

     $pool.processModel.userName =$username;

     $pool.processModel.password = $newpassword;

     $pool.processModel.identityType = 3

     $pool | Set-Item

 }

  

 Write-Host "Application pool passwords updated..." -ForegroundColor Magenta 

 Write-Host "" 

$serviceList = @( gwmi -Class Win32_Service  -Property Name,StartName,SystemName -ErrorAction Stop ) 

foreach ($svcD in $serviceList)

{

    if ($svcD.StartName.ToString().ToLower() -eq $username.ToString().ToLower())

    {

        Write-Output ("Found service named " + $svcD.Name + " using identity of " +$username + "...");

            $StopStatus = $svcD.StopService() 

        If ($StopStatus.ReturnValue -eq "0") # validating status - http://msdn.microsoft.com/en-us/library/aa393673(v=vs.85).aspx 

            {write-host "$ServerN -> Service Stopped Successfully"} 

        $ChangeStatus = $svcD.change($null,$null,$null,$null,$null,$null,$username,$newpassword,$null,$null,$null) 

        If ($ChangeStatus.ReturnValue -eq "0")  

            {write-host "$ServerN -> Sucessfully Changed User Name"} 

       $StartStatus = $svcD.StartService();

        If ($StartStatus.ReturnValue -eq "0")  

            {write-host "$ServerN -> Service Started Successfully"} 

        Else 

            {

            Write-Host "Failed to restart service $svcD.Name on $ServerN.  Please check the server and restart manually." -ForegroundColor Magenta

            }

    }

}

Write-Output "Updating SharePoint Managed Accounts...";

    $m = Get-SPManagedAccount -Identity $username;

    if ($m -ne $null)

    { 

        Write-Host ("Running Set-SPManagedACcount for $($username).");

        Set-SPManagedAccount -Identity $m  -ExistingPassword $newpasswordSS

        

    }

 

}