AD Domain Administrator password and name change

Changing the AD domain administrator username is good practice, as is a regular change to the password.  Our password had remained the same for a good long time due to fear of breaking things (and an apparently inaccurate belief that one system in particular would break).

In practice it isn't so bad:

1. Get Service Credentials Manager from http://www.cjwdev.co.uk/Software/ServiceCredMan/Info.html - very handy tools to trawl the network getting the details of all services and scheduled tasks along with their login account details
2. Run the above - if your network is small the free version of the tool is sufficient.  Larger networks would benefit from the ability to export the output to Excel, so the paid version is a better option.  What comes out of this will help you plan the change - if nothing or little runs as the domain administrator then the process is generally quick and smooth.
3. In Active Directory Users and Computers, right click on the administrator account and click on Rename - enter the new name.  Log our and back in as this user, if you are logged in as it (though you should be using individual admin accounts that are separate from your day-to-day logins).
4. Again in ADUC right click on the administrator account and select Reset Password.  At this point the change is done.
5. Wait for AD to propagate the change to other DCs (if you have any), or force it with 'repadmin /syncall <other DC name> /Adep'
6. Now go to any system with services or scheduled tasks that run as the administrator account.  Ideally, create new account for these (local ones if possible, or domain ones with no or restricted logon rights) and use one account per service 'group' (so one for the Veeam services, for example).  Restart said services and make sure things all still work.
7. Also look out for applications which cache credentials in their config.  Backup Exec, for example, or Veeam ONE - again, these shouldn't be the domain administrator account, but if they are they will need updating (or ideally replacing with dedicated accounts).

Note that using dedicated accounts for services might require that they have local admin rights.  In our case we had a couple of services on the Domain Controllers (not ideal, but needs must..) so adding the account to the local administrators group wasn't possible via the GUI.  To do this from the command line :

net localgroup Administrators /add DOMAIN\USERNAME

Also a lot quicker than doing it via the GUI on the non-DC systems.