Besides the ICAPool in IIS and the IBM Cognos Service is there another (potentially embedded) place where the service account password is used? After changing the password in these 2 locations the services started up successfully but the analytics sign-in fails for users and the cognos logs show "401 unauthorized" errors.
There's a lot of IBM articles available in their community but you may prefer to raise a support case to get assistance in troubleshooting your specific issue from Flexera Support.
Did you check the IBM Cognos Configuration application? I can find it on my server by searching for it by name in the start menu. Typical install path appears to be Program Files\ReportDesigner\c10_64\bin64 and the exe name is cogconfigw.exe
There's a whackton of settings in there. Not sure what they're all for as I only needed to update some DB server configs, but there are several options for various types of credentials.
