Promote Team Foundation Server from Workgroup to Domain

  • Article

If you already installed the Team Foundation Server in a workgroup, and you plan to promote it to a domain.
What you need to do is to change the two service accounts ([computername\TFSSERVICE], [computername\TFSREPORTS]) usernams and passwords
You can use the TFSAdminUtil utility with the ChangeAccount argument. This tool updates Team Foundation servers by replacing the old service account information with the new information.
Before you assign the new account by using TFSAdminUtil Changeaccount command, the account must have the Log on as a service permission on the application-tier server.

First, you need to assign a new service account to all Team Foundation Server services

1. From the command line, locate the TFSAdminUtil utility.

By default, it is located in <drive> :\Program Files\Microsoft Visual Studio 2005 Team Foundation Server\Tools.

2. At the command line, type TFSAdminUtil ChangeAccount oldAccount newAccount newPassword, and then press ENTER.

You must enter the user name for the old Team Foundation Server service account (oldAccount), in addition to the user name and password for the new account (newAccount and newPassword).

Next, you need to change the Team Foundation Server Report Service Account

Here is how you can update credentials for the Reporting Service data sources

1. Start Internet Explorer.

2. Open https://ApplicationTierServerName/Reports.

3. On the Contents tab, select TfsReportDS.

4. On the Properties tab, update the User name and Password for Credentials stored securely in the report server, and then click Apply.

5. Repeat the steps three (3) and four (4) for TfsOlapReportDS.

Last step is that you need to edit the MSIProperty.ini file after you run TfsAdminUtil ChangeAccount on the TFSService account or the TFSReports account.

Here is how you can grant log on permission to the user

To grant the log on as a service permission to a new service account on a Team Foundation Server in an Active Directory domain

1. On the Windows Taskbar, click Start, and then click Run.

2. In the Open box, type mmc, and then click OK.

3. On File menu of the Console window, click Add/Remove Snap-in.

4. On the Add/Remove Snap-in dialog box, click Add.

5. On the Add Standalone Snap-in dialog box, double-click Group Policy Object Editor in the Available Standalone Snap-ins pane.

The Group Policy Wizard starts.

6. On the Select Group Policy Object page, click Browse.

7. On the Browse for a Group Policy Object dialog box, locate the policy object you want to modify, and then click OK.

8. Click Finish on the Select Group Policy Object page.

9. On the Windows taskbar, click Start, point to Administrative Tools, and then click Local Security Policy.

10. Expand Local Policies in the Explorer pane of the Local Security Settings window.

11. Click User Rights Assignment.

12. Double-click Log on as a service on the viewing pane.

13. Click Add User or Group on the Log on as a service Properties dialog box.

14. Type the name of the new service account in the Enter the object names to select box.

15. Click OK.