Changing an exchange service account in small business Server. By Collins Mutesasira 22-03-2001

It may not be recommended to change an exchange service account  because of the messaging problems that my arise after a service account has been changed, but has any one ever imaged a situation when a real necessity to change a service account arises? A situation may especially to those administrators who use the administrator account as the exchange service account, you may be required to change your administrator's account for your domain, meaning that if you used the same account as the exchange service account, you find your self in the situation a trying to talk about.-Change the exchange service account.  This process may be a bit complex in a large exchange organization as opposed to an organization with a few exchange servers and sites.

Below, I am taking you through what you may need to do if the need to change an exchange account becomes a necessity.

First of all, identify or create an account you want to make an exchange service account, remember to check "password never expire" otherwise, if you don't, it may turnout to be a brain teaser if that password expires and you can not figure out why the System Attendant service and its dependences can not start.

Then you assign the account service account admin rights at the Organisation, site and configuration levels in exchange administrator. You may find it necessary to change the password on Service account password tab on the Configurations Properties. Then open up control panel, double click on services, and look out for the Microsoft exchange services. These may be services like MS exchange system attendant, Ms Exchange directory, MS information store, Ms Exchange event service, MS exchange Internet mail service, etc depending on the exchange components on your exchange server. On each of these services, click to select the service and then click on startup. On the "Log on as" section , select "This Account" if not already selected, and change it to the new service account and password. 

Remember you have to change that account and password for each of the services that MS exchange uses on all exchange servers in your Organisation (assuming they are not too many) and leave your administrator account permissions Admin to give you back door entry to your exchange server, otherwise some exchange services may fail to start which may cripple your exchange Organisation.

At this stage the dance is not over Yet! I usually apply the latest MS exchange service pack after changing the service account then at the stage when all the services are restarting, a dialogue box pops up telling you that account "x*******x" has been granted logon as a service right.

Usually after restarting your exchange server (S), Event error ID: 4018 " Unable to start the internet mail connector service because MAPI could not be initualised" and Event Error ID: 4116 "An error was returned from the messaging software the internet mail service uses to process messages on the Microsoft exchange server. It is possible that the piece of mails being processed at this time will not be delivered. The message that was being processed has been moved to the "BAD" folder. Use the appropriate utilities found in the support directory of the exchange CD to view and manipulate these messages."

The two errors occur because the exchange service account does not have proper access rights to the \%systemroot%\system32 directory. The service must have at least change rights to this directory to modify the Mapisvc.inf file allocated in the \%systemroot%\system32 directory.

Then right click on the \%systemroot%\system32 directory, select properties, then security tab, assign the new exchange service account at least change permissions. (I usually give it full control). After doing this try to start the Microsoft Internet mail connector service which should start fine now.

The whole idea of changing an exchange service account is so tedious, tension filled and not recommended, that is why the exchange administrator should get it right from the start such that they do not have to go through all that. But if you are brought in as an expert to put things right, then no option, you have to do it.

Back                                 Comment