ChangeAccount Command

  • Article

Use ChangeAccount to change account and password settings for all service accounts. For more information, see Managing Team Foundation Server Services and Service Accounts.

Required Permissions

To use the ChangeAccount command, you must be a member of the Team Foundation Administrators security group on the Team Foundation application-tier server and a member of the sysadmin security group on the SQL Server on the Team Foundation data-tier server. If you use the /proxy option, you must be an administrator on the Team Foundation application-tier and data-tier servers or the proxy server. For more information, see Team Foundation Server Permissions.

Note

Even if you are logged on with administrative credentials, you must open an elevated Command Prompt to perform this function on a server that is running Windows Server 2008. To open an elevated Command Prompt, click Start, right-click Command Prompt, and click Run as Administrator. For more information, see the Microsoft Web site.

TFSAdminUtil ChangeAccount [/ra] [/proxy] oldacct newacct newpwd [emailAddress]

Parameters

Argument

Description

oldacct

Specifies the old account name.

newacct

Specifies the new account name.

newpwd

Specifies the new account password. Not required for system accounts.

emailAddress

Optional. Specifies the new e-mail address from which alerts are sent. Do not use this argument with the /ra option.

Option

Description

/ra

Specifies that the account and password settings are changed for the reporting services service account.

If this option is not provided, the account and password settings are changed for the Team Foundation Server service account.

/proxy

Specifies that the account and password settings are changed for the Team Foundation Server proxy account.

Remarks

Important noteImportant Note:

We recommend that you back up the databases in the Team Foundation Server data tier server.

The ChangeAccount command is used by an administrator who wants to replace the service account, for example, MyLocation\TFSSERVICE, with another pre-crafted service account such as MyLocation\tfssvc.

Before you assign a new account domain or workgroup by using the TFSAdminUtil ChangeAccount command, the account must have the account is sensitive and cannot be delegated permission on the application-tier server. For more information, see the Microsoft Web site.

The utility updates the service accounts as follows:

  1. Changes the new account information for the application pools on the Team Foundation application tier. This step is skipped if the /ra option is specified. The application pool is restarted individually by the utility. Internet Information Services (IIS) does not have to be restarted manually.

  2. Changes the services in the Team Foundation database. Assigns the new account to the same role group as the old account, TFSExec. This makes sure that permissions are maintained and that there is no SQL Server downtime on the data tier. The old user account might have to be removed manually from the data tier after successfully changing accounts. For example, if you specified the old account incorrectly, the system cannot remove it.

  3. Updates and restarts the Visual Studio Team Foundation Server Task Scheduler and the CoverAn services for changes to take effect. This step is skipped if the /ra option is specified.

  4. Adds the Log on as a service permission to the new account, and removes that permission from the old account (for domain and workgroup accounts only). This step is skipped if the /ra option is specified.

  5. Updates the Reporting Services data sources with the Reporting Services service account information. This step is completed only if the /ra option is specified.

For more information, see Visual Studio Team Foundation Server Task Scheduler. For a build service, the account and the password must be changed manually. For more information, see How to: Change the Password for Visual Studio Team Foundation Build Service.

If you specified an e-mail account, the e-mail from where the alerts are sent is changed also.

Example

The following example shows the syntax used to update service accounts. The utility swaps all instances of the old account, MyOldAcct, with a new account, MyNewAcct, and new password, newPass. The utility iterates through the services and only changes those that run under the old account.

>TFSAdminUtil ChangeAccount MyOldAcct MyNewAcct newPass

The following example shows the syntax used to update the password and account for the reporting services service accounts.

>TFSAdminUtil ChangeAccount /ra MyOldAcct MyNewAcct newPass

The following example shows the syntax used to change the service account from a domain account, MyOldAccount, to Network Service. Note that for a system account, there is no password.

>TFSAdminUtil ChangeAccount MyDomain\MyOldAccount "NT Authority\Network Service"

The following example shows the syntax used to change the e-mail account to someuser@mydomain.com as you are changing the service account to use the Network Service system account.

>TFSAdminUtil ChangeAccount MyDomain\MyOldAccount "NT Authority\Network Service" someuser@mydomain.com

See Also

Tasks

How to: Change the Service Account or Password for SQL Server Reporting Services

Other Resources

Using Team Foundation Server Command-Line Tools

Administering Team Foundation Server

Managing Team Foundation Server Services and Service Accounts