SharePoint 2013: how to change a web application pool identity

Introduction
This posting explores how to change a web application pool identity using PowerShell methods.  It assumes that both the current and target identities are configured as managed accounts (this makes things much simpler).  You'll start out by first just reviewing the current identity of the web application.  Next, you'll execute a few very simple scripts that change change the application pool configuration to the target managed account. All references used in this posting are listed below.

Procedure

1. Review existing web application pool identity
1. Log into a SharePoint 2013 server using the SharePoint Setup User Administrator account (eg, spAdmin). This is the same account that you (should have) used to perform the initial farm installation and configuration.

   This is important in that the changes you will be making will be to the farm configuration database; and, by default, only this account has the privileges necessary to make such changes.

2. Launch an elevated SharePoint Management shell.
3. Execute the following command, making appropriate revisions:

   $wa=Get-SPWebApplication "[YourSiteURL]"
   $wa.ApplicationPool
   

   This lists out all the pertinent information concerning the web application pool's identity. A useful command to remember for future reference.
2. Implement the change
1. Now, using the same management shell, execute the next few commands to make the change to the identity:

   $ma=Get-SPManagedAccount -Identity "[target managed account]"
   $wa.ApplicationPool.ManagedAccount=$ma
   $wa.ApplicationPool.Update()
   $wa.ApplicationPool.Deploy()
   

   The change will be implemented immediately.
3. Verify the change
1. Log into one of the farm WFEs hosting the web application - use any administrator account.
2. Launch IIS Manager.
3. In the Connections tree, expand Application Pools.

   If you still see the original identity, press F5 to refresh - no need to recycle the application pool or perform an IIS reset.

References

• SharePoint User and Service Accounts
• Initial deployment administrative and service accounts in SharePoint 2013
• Account permissions and security settings in SharePoint 2013
• SharePoint 2013: Service Account Configurations and Permissions
• PowerShell
• Get-SPWebApplication
• Get-SPManagedAccount
• Miscellaneous
• Changing the Web Application Pool Identity using PowerShell

Notes

• Executing the first three lines in step 2.1), above, updates the farm configuration database, but does not update the identity among the application pools on the web front ends.  You can verify this by stopping after executing the Update() method, and then going to IIS on one of the WFEs and looking at the application pool identities listed there.  So, to get the update pushed out to the WFEs, you must execute the Deploy() method of the ApplicationPool property.