Best Practices to Change App Pool Account for SharePoint Web Application

Updating SharePoint Web Application Pool is one of the most common actions for SharePoint administration. I have repeatedly seen many SharePoint administrators and my fellow colleagues updating their SharePoint web application pool in the IIS and later realizing that their SharePoint content application is inaccessible and throws “Cannot connect to the configuration database” error.

The real reason behind this is when you create web application either through PowerShell or central admin, SharePoint configures application pool information at many different locations including machine level permissions, IIS, and database permissions. If you ever want to manually change the application pool, you must be aware of what really happens under the hood and visit all the different locations to change application pool manually. As you may think, manually changing all these machine level settings is tedious, error-prone, and requires better option. Luckily Microsoft has provided better option as manage service accounts page on the central administration site. It is best practice to change content web application pool or even service web application pool from the central administration to ensure SharePoint Content Web application runs smoothly.
You can use following step by step guide to change application pool for the given SharePoint web application. Additionally, it would walk you through what really happens under the hood and where SharePoint makes necessary changes to ensure Application Pool is configured properly.
Pre-requisites

• New AppPool account must be Domain User Account (e.g. Niks\SPAppPool)
• New AppPool account must register as SharePoint Managed Account

Changing Application Pool from the Central Administration
Visit Manage Service Accounts page on the central administration to change the application pool.



Run the IISReset after updating application pool to ensure all the configuration settings has been updated to access SharePoint Web Application correctly.

What really happens under the hood?
After you change the application pool through central administration, SharePoint automates various configuration settings changes at the machine level, IIS, and SQL Server.

• SharePoint Web Application App Pool in IIS

  

• Machine-level Permissions
  • New AppPool account added as Member in the WSS_WPG, AD Group
  • New AppPool account added as Member in the built-in IIS_IUSRS, AD Group

               

• SQL Server and database permissions
  • SharePoint will create new SQL Server Login for AppPool Account in the Database if it doesn’t exists
  • New AppPool account is assigned to the db_owner role for the Web application content databases.
  
  
  • New AppPool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the farm configuration database.
  
  
  • New AppPool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the SharePoint_Admin content database.
  
  
  • New AppPool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the StateService database.
  
  
  • New AppPool account will be assigned to the db_owner role for the associated user profile service application databases (e.g. Profile DB, Social DB, and Sync DB)

There you go. Regardless of what you do and where you manually change application pool account info, you still have to change application pool through manage security accounts screen. So, why not just change only at 1 place on manage security accounts screen and let SharePoint does it’s magic to update all the required places. Hopefully this will help. !!!!!

Reference:

http://nikpatel.net/2012/01/25/best-practices-to-change-app-pool-account-for-sharepoint-web-applcation/

What is application pool in sharepoint?

Application Pool is not a Sharepoint concept rather an IIS Concept. It provides a logical separation to different web applications/websites. A single worker process caters to one application pool. This ensures that if an application running in an application pool crashes it doesn't affect the working of the rest being catered by other application pools.

Finding the application pool account for a web application

I get a lot of questions from people who read my post on Configuring claims and forms based authentication for use with a SQL provider in SharePoint 2010 about how to find the application pool account for a certain web application.

• The first thing you have to do is to find out what application pool is being used for you web application. In order to find this out we need to open up IIS (Internet Information Services) Manager. Click on “Start” – “Administrative Tools” – “Internet Information Services (IIS) Manager”.

• Open up the drop down on the left and look for your web application in the “Sites” list.
• Select the web application you want to find the application pool account for and click “Basic Settings’ in the panel on the right.

In my case the application pool for my web application is “SharePoint – Web Apps”.

• Now we have to find the application pool account and we have two ways in which we can do this.
• We can find the application pool account in IIS by selecting “Application Pools” in the left panel. This will show the list of application pools in the middle.
• Find the application pool that you found in the basic settings of your web application. Right of the name of the application pool the application pool account is displayed. If you are looking for the application pool account of your Central Administration web application you can simply look to the right of the “SharePoint Central Administration v4” application pool. In my case the application pool account of my Central Administration web application is “SOLUTIONS\spfarm”.

• If you know the application pool of your web application you can also find the application pool account from the SharePoint user interface.
• In order to do this open up Central Administration and click on “Security”.
• Now click on “Configure service accounts”.

• In the drop down select the application pool of your web application. This will display the application pool account in the text box.

• If you are looking for the application pool account of your Central Administration web application you have to select “Farm Account” in the drop down box. The farm account is also the application pool account of your Central Administration web application and selecting farm account in the drop down will make the account show up in the text box.

That’s all there is to it!

Reference:

http://www.sharepointchick.com/archive/2011/10/29/finding-the-application-pool-account-for-a-web-application.aspx