SharePoint 2013: How to change the Distributed Cache service account

Introduction

You cannot change the Distributed Cache service account through Central Administration.  You must use PowerShell.  This posting shows you how.

When you first install and configure a SharePoint 2013 farm, the farm's Distributed Cache is initially run under the farm service account.  It's set to this service account automatically.  This situation will eventually trigger a rule definition error:

Title	The server farm account should not be used for other services.
Severity	1 - Error
Category	Security
Explanation	[farmServiceAccount], the account used for the SharePoint timer service and the central administration site, is highly privileged and should not be used for any other services on any machines in the server farm.  The following services were found to use this account: Distributed Cache Service(Windows Service)
Remedy	Browse to [your CA host]/_admin/FarmCredentialManagement.aspxand change the account used for the services listed in the explanation. For more information about this rule, see "http://go.microsoft.com/fwlink/?LinkID=142685".
Failing Servers
Failing Services	SPTimerService (SPTimerV4)
Rule Settings	View

 
The remedy presented by this rule definition error works for most service accounts, but not for the Distributed Cache service.  In fact, if you navigate to CA > Security > Configure service accounts, and then try to change the service account for Windows Service - Distributed Cache, you will experience an error:

The only way to change this at present, is to use PowerShell.  These steps are shown next.

Procedure

1. Identify an AD account that you want to use for the Distributed Cache service account.
2. Register this account with the farm as a managed account.
3. Login to a farm server using your administrator account.  No need to use the farm administration account, just your own.
4. Open a farm management shell as administrator (right-click, choose Run as Administrator).
5. Execute each of the following statements, in order:
   

   $Farm=Get-SPFarm
   $CacheService=$Farm.Services | Where {$_.Name -eq "AppFabricCachingService"}
   $Accnt = Get-SPManagedAccount -Identity Domain\ServiceAccount
   $CacheService.ProcessIdentity.CurrentIdentityType = "SpecificUser"
   $CacheService.ProcessIdentity.ManagedAccount = $Accnt
   $CacheService.ProcessIdentity.Update()
    
   

   where Domain\ServiceAccount is the service account you identified previously.
   Though it states AppFabricCachingService, don't worry: you are configuring the right one.  This is because the Distributed Cache service is dependent on the App Fabric caching service.  Also, "SpecificUser" is not user-defined but is the correct value you need to type here.
6. Wait.  It can take several minutes for this to complete.
7. After completion, verify by navigating to:  CA > Security > Configure service accounts, selecting Windows Service - Distributed Cache.  The new account should now be displayed.

References

• TechNet: Manage the Distributed Cache service in SharePoint Server 2013
• Unable to change service account for the Distributed Cache

Notes

• Thanks to reviewer Mark for catching the fact that the Deploy method in this case is unnecessary.  I've added the reference he cites to the References section.