Accounts Command
You use the Accounts command to change the accounts and passwords for service accounts that Visual Studio Team Foundation Server (TFS) uses. These accounts include the service account for Team Foundation Server (TFSService), the data sources account for SQL Server Reporting Services (TFSReports), and the service account for Team Foundation Server Proxy (TFSProxy). You can also use this command to change the ownership of the databases that Team Foundation Server uses.
The Accounts command supports on-premises TFS deployments. To determine the account owner of Visual Studio Online accounts, see Change account ownership.
To change the user account or password interactively for the service account for Team Foundation Server (TFSService), you can use the administration console for Team Foundation. For more information, see Change the service account or password for Team Foundation Server.
Requirements
To use the Accounts command, you must be a member of the Team Foundation Administrators security group and a member of the sysadmin security group for any SQL Server databases that Team Foundation Server uses. If you use the /proxy option, you must be an administrator on the proxy server. For more information, see Permission reference for Team Foundation Server.
Note
Even if you log on with administrative credentials, you must open an elevated Command Prompt window to perform this function on a server that is running Windows Server 2008. To open an elevated Command Prompt window, click Start, right-click Command Prompt, and then click Run as Administrator. For more information, see this page on the Microsoft Web site: User Account Control.
TFSConfig Accounts /change|add|set|delete|updatepassword|resetowner [/AccountType:{ApplicationTier|ReportingDataSource|Proxy}] [/Account:AccountName] [/Password:Password] [/SQLInstance:ServerName] [/DatabaseName:DatabaseName] [/Continue] [/usesqlalwayson]
Parameters
Argument |
Description |
|---|---|
AccountName |
Specifies the name of the account that is used as the service account, in Domain\UserName or Computer\UserName format. |
Password |
Specifies the password for the account that is used as the service account. |
ServerName |
Used only with /resetowner /SQLInstance. Specifies the name of the server that hosts the databases for Team Foundation Server, and, if an instance other than the default instance is used, the name of the instance. If you specify an instance, you must use the following format: ServerName\InstanceName |
DatabaseName |
Used only with /resetowner /DatabaseName. Specifies the name of the database whose ownership will be changed. |
Option |
Description |
|---|---|
/change |
Changes the account that is used as the service account. This option adds the account that you specify to all the necessary groups, grants it the required permissions if possible, and sets the service to use the account. If you do not use the /AccountType option with this option, the service account for the application tier will be changed. |
/add |
Adds an account to the groups that are required for using the account as a service account. This option adds the account that you specify to the necessary groups and grants it the permissions that are required to act as the service account (if possible). However, this option will not change the account that is used as the service account. This option is usually used in network load balancing (NLB) scenarios. You can use this option with /continue if some services or databases might not be available in your environment. |
/set |
Sets an account as the service account. This option does not add the account to any groups. Therefore, you must use this option only with accounts that have already been added to the required groups and have the necessary permissions. This option is usually used in NLB scenarios. |
/delete |
Removes an account from the account type that you specify. This option removes the account that you specify from the necessary groups and removes the permissions that are required to act as the service account (if possible). However, this option will not change the account that is used as the service account. Make sure that you do not use this option for an account that the servers in your deployment currently use as a service account. |
/ResetOwner |
Changes the ownership of the databases that Team Foundation Server uses to the account that you are using to run this command. This option iterates though all the databases and sets the dbo login to the account that you are using to run this command. You might need to use this option when you move or restore a deployment. |
/UpdatePassword |
Changes the password of an account that is used as a service account. This option updates the password for the account that you specify for all services in Team Foundation Server that use that account. |
/AccountType:{AdminConsole|ApplicationTier|ReportingDataSource|Proxy} |
Specifies the account group that you are modifying: the group of users who have the minimum permissions that are required to open and use the administration console for Team Foundation (AdminConsole); the service account that is used for Team Foundation Server (TFSService), the data sources account for Reporting Services (TFSReports), or the service account for Team Foundation Server Proxy (TFSProxy). If you omit this option, the default value is ApplicationTier. |
/Account:AccountName |
Specifies the name of the account that you want to add, change, or delete from a referenced account type, such as /AccountType:ApplicationTier. Specify Account in one of the following forms: Domain\AccountName or Computer\AccountName. If you want to use a system account, such as Network Service or Local System, use the Computer\AccountName format. For more information about how to specify a system account, see the usage examples later in this topic. |
/Password:Password |
Specifies the password of the service account. Note This parameter is optional if you are using a system account or an account that does not have a password, such as Network Service. |
/SQLInstance:ServerName |
Used only with /ResetOwner. Specifies the name of the server that is running SQL Server and the name of the instance if you want to use an instance other than the default instance. You must specify the name and instance in the following format: ServerName\InstanceName |
/DatabaseName:DatabaseName |
Used only with /ResetOwner. Specifies the name of the database whose ownership you want to change. By using this command, you reset the ownership of the database that you specify to the account under which you are running the command. |
/continue |
Updates any groups that are not available when you run the command. This option is usually used in NLB scenarios. |
/usesqlalwayson |
Used only with /ResetOwner in conjunction with /SQLInstance and /DatabaseName. Specifies that the databases are part of an AlwaysOn Availability Group in SQL Server. If configured, this option sets MultiSubnetFailover in the connection string. For more information, see AlwaysOn Availability Groups (SQL Server). |
Remarks
Use the Accounts command to automate changes to the service accounts, databases, and service account groups of Team Foundation Server. You can configure accounts that you have already created, but you can’t create accounts.
Before you change the domain or workgroup of an account, the account must have the Account is sensitive and cannot be delegated permission on the application-tier server. For more information, see this page on the Microsoft Web site: Enabling Delegated Authentication.
Example
The following example shows how to change the service account of data sources for Reporting Services to a new account in the Contoso domain, Contoso\NewAccount, and the password, to Password.
Note
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, places, or events is intended or should be inferred.
TFSConfig Accounts /change /AccountType:ReportingDataSource /Account:Contoso\NewAccount /Password:Password
The following example shows how to add the Network Service system account to the service account groups for Team Foundation Server. System accounts do not have passwords.
TFSConfig Accounts /add /AccountType:ApplicationTier /Account:"NT Authority\Network Service"
The following example shows how to change the ownership of the database that is named TFS_Warehouse on the server that is running ssnoversion and that is named "ContosoMain" on the named instance "TeamDatabases" to the user account under which you are running the command.
Note
You cannot specify what account to set as the owner of the databases when you use this command. The owner will be set to the account under which you are running the command.
TFSConfig Accounts /ResetOwner /SQLInstance:ContosoMain\TeamDatabases /DatabaseName:TFS_Warehouse