RavenHawkTech LLC

SharePoint 2019 Farm Recovery and Managed Account Troubleshooting

SharePoint Recovery

SharePoint farm recovery can become complicated when managed account passwords, farm passphrases, and configuration database encryption fall out of sync. This walkthrough summarizes a real-world SharePoint 2019 recovery scenario where content databases remained healthy, but managed account operations failed due to encryption and passphrase problems.

Environment Context

This recovery case involved troubleshooting SharePoint 2019 managed account and farm passphrase issues after a farm account password change and server desynchronization.

The most important discovery was that SharePoint sites and web applications were still serving content normally, even though farm-level account and encryption operations were failing behind the scenes.

Symptoms Observed

  • SharePoint sites and web applications continued functioning normally.
  • Managed account operations failed with Error during decryption. System error code 0.
  • New-SPManagedAccount failed repeatedly.
  • Set-SPPassPhrase failed due to passphrase mismatch or decryption issues.
  • LMS-SP02 could not rejoin the farm.
  • The farm account password had previously been changed outside SharePoint.
  • Managed account automatic password rotation had been enabled.

Key Findings

  • The SharePoint content databases were healthy and continued serving sites.
  • The configuration database encryption state was tied to a farm passphrase that was no longer known.
  • The farm account password had likely been automatically rotated by SharePoint.
  • The restored or rebuilt server could not decrypt or re-encrypt managed account credentials.
  • Timer services and IIS continued working due to cached credentials and existing tokens.
  • Managed account operations requiring encryption or decryption failed consistently.

Recovery warning: A working SharePoint site does not always mean the farm is healthy. Cached credentials and running services can hide deeper configuration database, passphrase, or managed account failures until the next administrative change or server rebuild.

Useful Commands That Worked

Verify Managed Accounts

Get-SPManagedAccount | Format-Table UserName, PasswordExpiration, Automatic, ChangeSchedule

Verify the Farm Default Service Account

(Get-SPFarm).DefaultServiceAccount

Load the SharePoint PowerShell Snap-In

Add-PSSnapin Microsoft.SharePoint.PowerShell

Disconnect a Server from the Farm

psconfig.exe -cmd configdb -disconnect

Run SharePoint Upgrade Synchronization

psconfig.exe -cmd upgrade -inplace b2b -wait -force

Restart the SharePoint Timer Service

net stop sptimerv4
net start sptimerv4

Reset IIS

iisreset /noforce

What Ultimately Worked

  • Confirmed the content databases and sites remained healthy on LMS-SP01.
  • Verified the farm passphrase mismatch was the root cause of managed account failures.
  • Determined the managed service account password had changed independently of SharePoint.
  • Confirmed SharePoint automatic managed-account password rotation had been enabled.
  • Verified that rebuilding or recreating the farm configuration database would be the cleanest long-term recovery path.
  • Established a supported migration strategy: build a new farm on LMS-SP02 and attach existing content databases.
  • Confirmed LMS-SP01 can continue serving content while the new farm is built.

Recommended Recovery Strategy

The recommended long-term solution is to create a brand-new SharePoint farm with a new configuration database and a known passphrase on LMS-SP02. Once validated, the existing content databases can be attached to the new farm and DNS or load balancing can be updated to complete migration with minimal downtime.

Key takeaway: When the configuration database encryption state and managed account system are no longer trustworthy, rebuilding the farm and attaching known-good content databases can be safer than forcing more changes into a broken configuration database.

Important Lessons Learned

  • Do not manually change SharePoint managed account passwords outside SharePoint unless automatic password management is disabled.
  • Always document and securely store the SharePoint farm passphrase.
  • Automatic managed-account password rotation can complicate disaster recovery if the passphrase is lost.
  • Content databases can remain healthy even when farm encryption and managed account systems are broken.
  • A new SharePoint farm can safely reuse existing content databases.

Final Thoughts

This SharePoint 2019 recovery case is a useful reminder that application availability and farm manageability are not always the same thing. Sites may continue to serve users while the underlying farm configuration, managed account encryption, and recovery path are already compromised.

Documenting the farm passphrase, controlling managed account password changes, and maintaining a tested content database migration path can make the difference between a controlled recovery and a prolonged outage.