in this first post of a series of post that will follow describes the new feature “managed accounts” feature introduced with the new version of SharePoint 2010. This feature is listed on this link under “sites” and is available in all SharePoint 2010 versions.
What is the managed accounts feature?
Usually, in a SharePoint farm an administrator is concerned in managing more than one account needed by the farm to function properly (e.g., service account, farm account, application pool accounts etc.). Most of the time, it was necessary to change the passwords of these accounts depending on security needs or corporate policies. This task was not always easy to accomplish with the versions earlier than SharePoint 2010. With the introduction of SharePoint 2010 this problem was solved by introducing the managed accounts feature. You have to register an account as managed account in SharePoint 2010 if you want to use it either as a service account or application pool account. In addition, you have the possibility to delegate the password change tasks directly to SharePoint.
Requirements
The password change of the managed accounts feature does only work if your account is not set to “User cannot change password”. If this flag is set, the change password functionality is greyed out.
If you want to receive e-mail notification events, the e-mail settings of the farm must be configured with a valid e-mail address and server.
The management accounts in central admin
The managed accounts feature is reachable in the central administration under the “security” tab. You will find there under “General Security” two options that are of interest for us:
- configure managed accounts: this page gives you the ability to register a managed account and manage the passwords of it
- configure password change settings: the page that specifies the e-mail with all the notifications needed to receive password change notifications
Configure managed accounts
When you press the “Configure managed accounts” link, you will jump directly into the managed accounts overview page. In this page you get an overview of all your managed accounts of the farm and the scheduled password changes.
You can either register a new managed account with the “Register Managed Account”, and edit or delete existing managed accounts. If you choose to edit an existing managed account, you will see something like that:
You can see that most options are self-explanatory. You can either change the password immediately with a password you choose, or you enable the automatic password change. You can setup when the password changes deepening on the expiry policy settings of your company. In addition, an administrator can be notified by mail to get an overview about all actions that occur.
Configure password change settings
When you press the “Configure Password Change Settings” you will jump directly into an settings page that gives you the possibility to specify the e-mail address that should receive all notifications related to the password changes of your managed accounts.
Summary
The managed accounts feature of all versions of SharePoint 2010 simplifies the password management of your service accounts and application pool accounts used in your farm.
Hope this helps,
Patrick
