Change the Service Account or Password for SQL Server Reporting Services
You can help improve the security of Team Foundation Server by changing the service account that it uses for the data sources for SQL Server Reporting Services or by changing the password that is used for that account. Team Foundation Server acts in the security context of a service account when it retrieves project data from the data sources in SQL Server Reporting Services. Team Foundation Server documentation refers to this service account by the placeholder TFSReports. The actual account name depends on your installation. You might need to change the password of that account, or designate a different account. For example, if the password of the underlying account expires, and you assign a new password, you must change the password of the TFSReports account in Team Foundation Server to match.
The TFSConfig utility does not create a new account to use as the data sources account, nor does the utility change the account password. Instead, the utility updates Team Foundation Server to use a different set of credentials.
You change the password or account used as the TFSReports account by using the TFSConfig command-line utility with the Accounts option.
Important
The TFSConfig utility changes only those services that run under the old account.
You can use the same utility to assign a different account to be the TFSReports account, but you might need to perform one or more of the following additional actions:
Before you assign an account to use as the TFSReports account, you must verify that it is a member of a workgroup or domain that is trusted by every computer in the deployment of Team Foundation.
You must manually grant the account that you will use as the TFSReports account the Allow log on locally permission. The TFSConfig utility does not grant this permission when it assigns the account.
Optionally, after you use TFSConfig to specify an account to use as the TFSReports account, you can revoke its Log on as a service permission, which TFSConfig automatically grants to the TFSReports account. TFSReports does not need this permission, but the TFSService account does. Therefore, you should not remove this permission if you use the same domain or workgroup account for both service accounts.
For more information about the Log on as a service permission, see this page on the Microsoft Web site: Add the Log on as a service right to an account. For more information about the Allow log on locally permission, see this page on the Microsoft Web site: Allow log on locally.
For more information about required service accounts, see the topic Service Accounts and Dependencies in Team Foundation Server and also the topic "Accounts Required for Installation" in the installation guide for Team Foundation. To download the most recent version of this guide, see this page on the Microsoft Web site: Installation Guide for Team Foundation.
Required Permissions
To perform these procedures, you must be a member of the Administrators group on the server where TFSConfig is installed. You must also be a member of the sysadmin group on the server that hosts the configuration database. For more information about permissions, see Team Foundation Server Permissions.
In addition to these permissions, you might need to address the following requirements on a computer that is running Windows Server 2008 or Windows Vista:
To follow a command-line procedure, you might need to open an elevated Command Prompt by clicking Start, right-clicking Command Prompt, and clicking Run as Administrator.
To access Report Manager, reports, or Web sites for SQL Server Reporting Services, you might need to add these sites to the list of trusted sites in Internet Explorer or start Internet Explorer as an administrator.
For more information, see this page on the Microsoft Web site: User Account Control.
Changing the Password or Account for the Reporting Services Account
To change the password of the TFSReports account or to assign a different account, you must log on to a server that hosts the application services for Team Foundation and use the TfsConfig Accounts utility.
Note
Depending on your deployment configuration, you might need to restart Internet Information Services (IIS) after you complete this procedure for the changes to take effect.
To change the password using the TFSConfig utility
Open a Command Prompt window and change to the directory that contains the TFSConfig utility.
By default, the utility is located in Drive:\Program Files\Microsoft Team Foundation Server 2010\Tools.
At the command line, type **TFSConfig Accounts /UpdatePassword /accountType:ReportingDatasource /account:**AccountName **/password:**newPassword, and then press ENTER.
Replace AccountName with the name of the current TFSReports account. Replace newPassword with the new password of the account.
To assign a new reporting services service account to all Team Foundation Server services using the TFSConfig utility
Open a Command Prompt window and change to the directory that contains the TFSConfig utility.
By default, the utility is located in Drive:\Program Files\Microsoft Team Foundation Server 2010\Tools.
At the command line, type **TFSConfig Accounts /change /accountType:ReportingDatasource /account:**NewAccountName **/password:**newPassword, and then press ENTER.
Replace NewAccountName with the name of the new TFSReports account. Replace newPassword with the password of the account.
See Also
Tasks
Change the Service Account or Password for Team Foundation Server
Reference
Concepts
Service Accounts and Dependencies in Team Foundation Server