We have a stable SP 2013 production farm but after changing farm admin service account I have been facing strange issues. I did all the guidelines mentioned here: https://social.technet.microsoft.com/wiki/contents/articles/36418.sharepoint-2013-how-to-change-all-service-account-passwords.aspx Executed commandline setting password refresh Managed accounts etc. Overall site collection is loading just fine. External Content type lists throw error: "Message from External System : 'Cannot logon with credentials obtained from Secure Store Provider.'." User Profile Service is always in starting state. I tried refresh, Stop-SPServiceInstance -Identity GUID. I later tried with GetTimeJob GUID and Timer.Delete() Its never turns out 'started'. I rebooted several times farm but no use. We have many custom properties cant take risk recreating. Is there any other settings I have to do to ensure that existing SP services are not breaking? Please advise.

Thank you. I haven't updated manually FIM credentials. The issue was finally resolved by taking out database from availability group(my error description was not same but similar) since we setup always-on availability. Restart timer service and then stop all user profile services from both servers(anyway stop service was not at all problem as it was only use to stuck at starting) Enable the User Profile service one server at a time. Once confirm both user profile and synchronizations services are up and running, only then start 2nd Web server. https://video2.skills-academy.com/en-us/sharepoint/troubleshoot/administration/cannot-start-the-user-profile-synchronization-service Hope this helps somebody who is looking for UPS issues in a SP farm. Thanks Shri

Thank you. I tried this but the error is still exist. Just to be clear here are the details I tried After I changed the password in Active Directory Executed below command on both WFE servers $username="spportal\SP_Admin" $newpassword=ConvertTo-SecureString -String "xxxxxxxxxxxx" -AsPlainText -Force Set-SPManagedAccount -Identity $username -ExistingPassword $newpassword -UseExistingPassword:$true 'Services' turn on or restart all except FIM services as Microsoft recommends not to start from Services IIS Application pool reset the new password Central Admin -> Managed account -> Edit and update the password Upprovision and provision UPS error remains there Rebooted both WFE servers I also updated again with STSADM -o updatefarmcredentials -userlogin spportal\sp_admin -password xxxxxxxxxxxxxxx [-local] - both with local and without I tried. Reset IIS I am also see in the event viewer randomly FIM error: “BAIL: MMS(360): server.cpp(374): 0x8023043f (Service start up has failed. A connection to SQL Server could not be established because of an authentication failure.)” Please advise any other suggestion. I am also planning to delete UPSA without database delete and plan to create new UPSA and hookup with existing Profile DB, Sync DB and Social DB. Please let me know if this will connect if Service establishing is on the same server. Appreciate any help.

SP farm account password change breaking several services

Shri-6058 326

We have a stable SP 2013 production farm but after changing farm admin service account I have been facing strange issues. I did all the guidelines mentioned here: https://social.technet.microsoft.com/wiki/contents/articles/36418.sharepoint-2013-how-to-change-all-service-account-passwords.aspx

Executed commandline setting password refresh Managed accounts etc. Overall site collection is loading just fine.

External Content type lists throw error: "Message from External System : 'Cannot logon with credentials obtained from Secure Store Provider.'."
User Profile Service is always in starting state. I tried refresh, Stop-SPServiceInstance -Identity GUID. I later tried with GetTimeJob GUID and Timer.Delete() Its never turns out 'started'. I rebooted several times farm but no use. We have many custom properties cant take risk recreating.
Is there any other settings I have to do to ensure that existing SP services are not breaking?

Please advise.

Accepted answer

Shri-6058 326 Reputation points

2021-01-13T01:55:55.933+00:00

Thank you. I haven't updated manually FIM credentials.

The issue was finally resolved by taking out database from availability group(my error description was not same but similar) since we setup always-on availability. Restart timer service and then stop all user profile services from both servers(anyway stop service was not at all problem as it was only use to stuck at starting) Enable the User Profile service one server at a time. Once confirm both user profile and synchronizations services are up and running, only then start 2nd Web server.

https://video2.skills-academy.com/en-us/sharepoint/troubleshoot/administration/cannot-start-the-user-profile-synchronization-service

Hope this helps somebody who is looking for UPS issues in a SP farm.

Thanks
Shri
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

5 additional answers

Shri-6058 326 Reputation points

2021-01-08T22:14:42.77+00:00
Thank you. I tried this but the error is still exist. Just to be clear here are the details I tried

After I changed the password in Active Directory

Executed below command on both WFE servers

$username="spportal\SP_Admin"
$newpassword=ConvertTo-SecureString -String "xxxxxxxxxxxx" -AsPlainText -Force
Set-SPManagedAccount -Identity $username -ExistingPassword $newpassword -UseExistingPassword:$true

'Services' turn on or restart all except FIM services as Microsoft recommends not to start from Services

IIS Application pool reset the new password

Central Admin -> Managed account -> Edit and update the password

Upprovision and provision UPS error remains there

Rebooted both WFE servers

I also updated again with STSADM -o updatefarmcredentials -userlogin spportal\sp_admin -password xxxxxxxxxxxxxxx [-local] - both with local and without I tried.

Reset IIS

I am also see in the event viewer randomly FIM error:
“BAIL: MMS(360): server.cpp(374): 0x8023043f (Service start up has failed. A connection to SQL Server could not be established because of an authentication failure.)”

Please advise any other suggestion.

I am also planning to delete UPSA without database delete and plan to create new UPSA and hookup with existing Profile DB, Sync DB and Social DB. Please let me know if this will connect if Service establishing is on the same server.

Appreciate any help.
Please sign in to rate this answer.
ChelseaWu-MSFT 6,326 Reputation points

2021-01-12T02:11:13.677+00:00

Have you tried manually updating the credentials on the FIM services? As far as I know, the FIM services do not necessarily need to start unless a user profile synchronization is required.

Referring to another post, creating a new user profile service application with connection on existing databases is workable. You can check it out here: https://sharepoint.stackexchange.com/questions/20632/creating-a-new-user-profile-service-application-with-exisiting-databases

In order to make sure the new user profile service application will run without credential errors, you can create a new one and keep the current one undeleted for test purpose.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

SP farm account password change breaking several services

5 additional answers

Your answer