We have installed Web8 recently. There is requirement we need to replace the local MTSUser with an Active Directory MTSUser. What configuration change we need to do for this update??

  • Hey Abdul - did the suggestions below work for you? Commented Jul 6, 2018 at 9:23
  • 1
    Dylan i followed jeroen answer and it worked well.we did not have any issue till now cms is working absolutly fine. Commented Jul 7, 2018 at 10:11
  • @AbdulQadir Could you please press the accept button next to his answer then? That will let other people with the same question know what worked for you :) Commented Jul 9, 2018 at 15:35
  • @PeterKjaer i did :) Commented Jul 10, 2018 at 13:23

2 Answers 2


Answer of Dominic is correct but incomplete. Here is the complete list as far as I am aware:

  • Update MTSUSer credentials of SDL Web Content Manager COM+ app
  • Update MTSUSer credentials in Tridion.ContentManager.config:
    • Search Query Engine Settings
    • Indexer Service Settings
    • Batch Processor
  • Update MTSUser in TranslationManager.xml
  • Grant MTSUSer access to the TridionRsaKeyContainer
  • Update MTSUSer in TRUSTEES table
    • Or add as new user as Administrator, optionally set to Predefined to hide user
  • Add MTSUSer to SDLSearchUsers group
  • Grant MTSUser the following file/folder permissions:
    • %ProgramData%\SDL\SDL Tridion\External Content Library: "Read,Write"
    • %SystemRoot%\Temp: "Read,Write,DeleteSubdirectoriesAndFiles"
    • %TEMP%: "Read,Write,DeleteSubdirectoriesAndFiles"
    • %TRIDION_CM_HOME%: "Read"
    • %TRIDION_CM_HOME%\config: "Write,ReadPermissions"
    • %TRIDION_CM_HOME%\config\cm_cnfg_git.dll: "ReadAndExecute,Write"
    • %TRIDION_CM_HOME%\config\Tridion.ContentManager.config: "FullControl"
    • %TRIDION_CM_HOME%\log: "Read,Write"
    • %TRIDION_CM_HOME%\web\Preview: "Read,Write"

In Web 8, the services generally run as System or Network Service, so you shouldn't need to change anything there.

You will need to change the identity of the SDL Web Content Manager application in COM+ as in this screen capture. (Note that my "MTS User" is called tridionsys)

Setting the identity in Component Services

The other thing you'll need to be aware of is that during installation, some of the settings in in the SDL Web configuration file are encrypted, and the key pair needed to decrypt these is associated with the Windows account used for the installation. Details of this can be found here.

If you consult the documentation for aspnet_iisreg, you will see that it is possible to export the keys from one account and import them to another.

I think that's all, but if anyone knows of something else, please jump in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.