There are many pieces in the SharePoint jigsaw puzzle and they should all rely on Active Directory accounts.
Every SharePoint Farm should follow these guidelines for the use of AD accounts http://www.wssdemo.com/redir.aspx?ID=1456
Unfortunately this is not always the case and, although everything appears to work when a single account is used for everything, there comes a time when corrective action is required to fix problems like:
- Search Results return unpublished pages
- Products like the SharePoint End-user Training kit can't be installed because the training site application pool is dbo of the content db.
- Regulatory compliance requires enforcement and auditing of content separation at the database level
If you are an old hand at managing Windows you might be tempted to jump right into the Services and IIS admin UI's and start changing accounts. Stop right where you are! There are a number of reasons why you should not do this.
For SQL Server you should always use SQL Server tools such as SQL Server Configuration Manager to change the account used by the SQL Server or SQL Server Agent services, or to change the password for the account. In addition to changing the account name, SQL Server Configuration Manager performs additional configuration such as setting permissions in the Windows Registry so that the new account can read the SQL Server settings. Other tools such as the Windows Services Control Manager can change the account name but do not change associated settings. If the service cannot access the SQL Server portion of the registry the service may not start properly.
Follow these steps to change the SQL account passwords http://technet.microsoft.com/en-us/library/cc263226.aspx
For SharePoint there are a number of Windows Services and IIS Application Pools. If you have multiple servers in your farm, these have to be in sync so you should use the STSADM commands or Central Admin UI. When you use these tools, they ensure that the appropriate registry, file system and data base permissions are also maintained across all servers in the farm. Everything may appear to work if you do make a manual change to a service or application pool but after a full farm restart you will find strange behaviours and errors all over the place (often with search or failure to create new sites). Always follow this procedure http://support.microsoft.com/kb/934838for the Farm, Search and SSP settings. Use Central Administration/Operations/Service Accounts menu to change the Application Pool accounts for other sites.