How to replace or change SCCM 2012 R2 install account

Question

Hello,
If we have a need to off-board/replace/change the user (Bob) who originally installed SCCM with, what would the reprocussions of such action be? Anyone attempted to do such a thing before? Is this 'supported'?
Details:
This user used their 'extra' account (Let's call it "BobAdmin") that had domain admin rights to install SCCM with, however since then have moved onto another role within the organization which is now not related to SCCM. While they have
retained their accounts "Bob" and "BobAdmin" we want to prevent this user from accessing/managing/logging into SCCM.
When we review the properties of any objects, we see this user's 'extra' account (BobAdmin) is listed as "Created by, Modified by" for most objects, including but not limited to:
"All Users" "All computers",
Security Scopes "Default" , "All"
Client Settings "Default Client Settings"
Boundaries, Sites, etc...
Not to mention SQL connectivity - this user is listed as having "public" and "smsdbrole_AITool" role memberships with "public" Server role.
Current role this user has (BobAdmin) is Full Administrator/all scopes/all collections, however, it is not listed in the "Administration | Security | Accounts" section.
Original install details: (clean/new) 2012 Datacenter edition, upgraded to SP1 CU3, then R2 CU1; SQL is 2008 R2 with plenty of resources etc. Primary Site only, Single AD domain, Multiple DP servers w PXE boot,
Single Reporting Server, Single Application web service/website, Software Update point... AD schema extended.
Option 1:
Rename user to something other than "BobAdmin" & change that accounts password (Not sure if this is the best option given how engrained some SCCM things are with Windows User profiles etc...)
Option 2:
Leave the user's name as is ("BobAdmin") & just change the password? Change the user's first/last name/description to reflect what it's used for now. (i.e. treat it like any other service account?)
Option 3:
Verify that we have other Full Administrators defined (Already done.)
Disable the user ("BobAdmin") and then in 30 days or so, delete this account if all works fine.
What happens to the "Created by, Modified by: verbiage if that happens"? (Prefer not to have to dig through the AD recycle bin to fix a broken SCCM...)
NOTE: Assume that we have full AD, site, sql & vm backups of these servers systems etc...
References
https://technet.microsoft.com/en-us/library/gg682088.aspx
What is the minimum I have to configure if I don’t want to use role-based administration while I’m testing System Center 2012 Configuration Manager?
If you install System Center 2012 Configuration Manager, there is no additional configuration because the Active Directory user account used to install Configuration Manager is automatically assigned to the
Full Administrator security role, assigned to All Scopes, and has access to the
All Systems and All Users and User Groups collections. However, if you want to provide full administrative permissions for other Active Directory users to access System Center 2012 Configuration Manager, create new administrative
users in Configuration Manager using their Windows accounts and then assign them to the
Full Administrator security role.
https://technet.microsoft.com/en-us/library/hh427337.aspx
https://technet.microsoft.com/en-us/library/hh427332.aspx

Answer 1

Option 1 or 2 are fine. Changing the user name has no effect as just like all good Windows apps, it doesn't reference the actual name but instead uses the SID.
Option 3 is not sufficient for every single thing delegated to this account. Granted, I can't name what these things are and they are very, very little used, but they do exist. If you do delete the account, the only way to get an equivalent one back is to
call support as it involves updating the DB directly.
Jason | http://blog.configmgrftw.com | @jasonsandys