If I run a Windows service on some host under a domain user account, and the password for this account changes at some later point, will the service now fail to start, until you update the password?

If not, how are the credentials for the domain user account persisted on the machine running the service in a way that allows them to survive a password change?


Yes if you change the password. Then you have to update password for the service too.

| improve this answer | |
  • What if the service is still running? Does it continue until it is stopped once? – Koen Aug 22 '11 at 14:46
  • Yes it keeps on running – proy Feb 29 '12 at 4:04

As an addition, in Windows Server 2008 R2 (and Windows 7) there's a new (or two) service account type (Managed Service Account) which will manage the passwords for you.

| improve this answer | |
  • +1 - Excellent comment Oskar - Managed Service Accounts is a new feature in Windows 2008 R2 that is easily overlooked. If you run services with domain accounts you should be looking into this new feature. – Dscoduc Jan 27 '10 at 17:11

Will the service now fail to start, until you update the password?

Yes. Which makes the 2nd question moot.

I usually disable password expiration for 'service' accounts, set them to an incredibly complex password, and disable their logon rights to every single machine and just add them to the local machine with whatever rights they require.

| improve this answer | |
  • Why not just use the Network Service Account? That's what it's for... – Dscoduc Jan 22 '10 at 1:04
  • we used a non log-in enable account for running services on our servers. password was some sort of face smashing into kb and was set to never expire. It worked out well for us. – aduljr Jan 22 '10 at 6:06
  • 5
    @Dscoduc, because sometimes we want to disable a particular service account at an enterprise level – Mark Henderson Jan 22 '10 at 21:32

A service account running with the credentials of a domain account that has recently changed the account password will run into a problem only during a restart of that service. Since the server hasn't been updated with the new password your service will not be able to authenticate the service account credentials until you update the service properties with the correct password.

That being said, it is recommended that you use the SERVER\NETWORK SERVICE account for services that require domain level access. The NETWORK SERVICE account is actually an alias account linking to the DOMAIN\SERVERNAME directory object in Active Directory.


Imagine your server running the service is ServerA and the resource your service needs access to is ServerB. By configuring the service to use the ServerA\NETWORK SERVICE account will actually be running with the DOMAIN\ServerA account. This has an added benefit of the automated computer password change mechanism that takes place (by default) every 30 days, transparent to you or your service.

Also, if you need to grant permissions for your service to communicate to the resource server (ServerB) in the same forest you can simply edit the access permissions on the ServerB to grant access permissions to the DOMAIN\ServerA account (remember it is the actual account for the ServerA\NETWORK SERVICE account) and then all requests to the resource on ServerB will be performed using the credentials of the DOMAIN\ServerA account.

All that being said, the Managed Service Accounts in Windows 2008 (thanks for pointing that out Oskar) looks to be an even better way to handle service account needs!

| improve this answer | |
  • This may be a good approach for smaller enviroments, however it doesn't scale at all. – Zypher Jan 22 '10 at 1:57
  • Perhaps you could add some additional thoughts to your response... – Dscoduc Jan 22 '10 at 2:41
  • Nice answer. I'm curious too, what doesn't scale? – blank3 Jan 27 '10 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.