A service account is not configured correctly

  • Article

The information in this article applies to:

  • Visual Studio 2005 Team Foundation Server

  • Visual Studio Team System 2008 Team Foundation Server

  • Windows Server 2003

  • Windows Server 2008 

  • Application-tier server

  • Data-tier server

  • Health check

The Best Practices Analyzer tool for Team Foundation Server queries the metabase for Internet Information Services (IIS) to determine the service account that is assigned to the application pool for Team Foundation Server (referred to as the TFSService account). The tool also queries the TfsIntegration database on the data-tier server to determine whether the TFSService account is a recognized user. An error appears if the TFSService account is not a member of the users group that is assigned to the TfsIntegration database.

The installation program for Team Foundation Server configures the TFSService account and credentials in the Team Foundation deployment. This configuration includes assignments for Team Foundation Server, SQL Server, and SharePoint Products and Technologies. If you do not set the TFSService account correctly or if you modify it incorrectly, errors will occur in any of the three applications. For more information, download the most recent version of the installation guide for Team Foundation, and see "User Accounts Required for Team Foundation Server Setup." To obtain this guide, see Accessing the Team Foundation Installation Guide.

To resolve this issue, you must reassign the service account for Team Foundation Server.

To reassign a service account that is assigned to null

  1. Be sure that the account that you want to use has the Log on as a service permission. For more information about this permission, see the Microsoft Web site.

  2. If the error "Cannot connect to the data tier computer" also appears, you might need to correct the connection string that is defined in the Services Web.config file. For more information, see The connection to the data-tier server failed.

  3. Use the TFSAdminUtil ChangeAccount utility to change or reassign the TFSService account.

    Note

    The TFSAdminUtil utility does not physically create an account or change its password. This utility only updates servers in a Team Foundation deployment to use the current credentials.

    For information about how to use this utility, see Update Service Account Information with TFSAdminUtil.

  4. If you have configured e-mail alerts, you must manually change the web.config file. Specifically, you must change the value of emailNotificationFromAddress from the old service account's e-mail address to the new service account's e-mail address. For more information, see "How to: Configure SMTP Server and E-Mail Notification Settings in the Services Web.Config File" on the Microsoft Web site.

  5. (For deployments of Visual Studio 2005 Team Foundation Server only) Change the MsiProperty.ini file to reflect the name of the new service account. For more information, see Update the MsiProperty.ini File.

Update Service Account Information with TFSAdminUtil

When the TFSAdminUtil ChangeAccount utility iterates through the services, it changes only those assignments that run under the old account.

Required Permissions

To perform this procedure, you must be a member of the Administrators security group on the application-tier server for Team Foundation and a member of the SQL Server Administrator group on the data-tier server for Team Foundation.

To assign a service account to all services for Team Foundation Server

  1. Log on to the application-tier server.

  2. At a command prompt, change directories to the location of the TFSAdminUtil utility.

    Note

    Even if you are logged on with administrative credentials, you must open an elevated Command Prompt to perform this function on a server that is running Windows Server 2008. To open an elevated Command Prompt, click Start, right-click Command Prompt, and click Run as administrator. For more information, see the Microsoft Web site.

    By default, it is located in the following directory (based on the version of Team Foundation Server):

    • Drive:\Program Files\Microsoft Visual Studio 2005 Team Foundation Server\Tools

    • Drive:\Program Files\Microsoft Visual Studio 2008 Team Foundation Server\Tools

  3. At a command prompt, type TFSAdminUtil ChangeAccount oldAccount newAccount newPassword, and then press ENTER.

    Specify the user name for the old service account (oldAccount), in addition to the user name and password for the new account (newAccount and newPassword).

Update the MsiProperty.ini File

When you reassign a service account for Visual Studio 2005 Team Foundation Server, you should update the MsiProperty.ini file after you run the TfsAdminUtil utility. You might need to update the MsiProperty.ini file so that servicing operations, such as repairing Team Foundation Server and installing or uninstalling service packs, can succeed.

Note

You do not need to perform this procedure for a deployment of Visual Studio Team System 2008 Team Foundation Server.

Required Permissions

To perform this procedure, you must be a member of the Administrators security group on the application-tier server for Team Foundation.

To update the msiproperty.ini file

  1. Log on to the application-tier server.

  2. Open the MsiProperty.ini file in a text-based editor, such as Notepad.

    Note

    Even if you are logged on with administrative credentials, you must open Notepad as an administrator to perform this function on a server that is running Windows Server 2008. To open Notepad as an administrator, click Start, right-click Command Prompt, and click Run as administrator. For more information, see the Microsoft Web site.

    By default, the MsiProperty.ini file is located in the following directory (based on the version of Team Foundation Server):

    • Drive:\Program Files\Microsoft Visual Studio 2005 Team Foundation Server\Microsoft Visual Studio 2005 Team Foundation Server

    • Drive:\Program Files\Microsoft Visual Studio 2008 Team Foundation Server\Microsoft Visual Studio 2008 Team Foundation Server

  3. In the file, make the following changes:

    • If you have changed the TFSService account, change the value of the following property to the name of the new account:

      **VSTF_USERID=**TFSService

    • If you have changed the domain of the TFSService account, change the value of the following property to the name of the new domain:

      **VSTF_DOMAIN=**TFSServiceDomain

  4. Save the file, and close the editor.

See Also

Other Resources

Issues That Relate to the Application Tier for Team Foundation