Managed Service Accounts || Understanding and Implementing in active directory
Managed Service Accounts Understanding and Implementing
What is group managed service accounts?
There are two types of service accounts in Active Directory.
Managed Service Accounts (MSA) – It was introduced in Windows Server 2008 R2 (msDS-ManagedServiceAccount object type). The main limitation is that such an account can only be used on a single server (it cannot be used to run cluster services).
Group Managed Service Accounts (gMSA) – introduced in Windows Server 2012 (msDS-GroupManagedServiceAccount object type). You can use GMSA accounts on multiple Windows servers but before using, you will have to decide which server or servers can use that.
Command to add one time root key before creating managed service account
Add-KdsRootKey –EffectiveImmediately (It requires wait for 10 Hours)
Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10))
Creating new sMSA
New-ADServiceAccount -Name msaMunSrv1 –RestrictToSingleComputer
Add-ADComputerServiceAccount -Identity server02 -ServiceAccount msaMunSrv1 -Enabled $True
Creating new gMSA.
New-ADServiceAccount -Name MSA-service1 -DNSHostName service1.company.local -PrincipalsAllowedToRetrieveManagedPassword server12$,server15$ (or any securty group)
Changing gMSA Settings
Set-ADServiceAccount -Identity Service-gMSA -PrincipalsAllowedToRetrieveManagedPassword server4$,server9$
Install-ADServiceAccount -Identity TestMSA ( we only need to install smsa, gmsa is not required to install)
Uninstall-ADServiceAccount -identity TestMSA
Remove-ADServiceAccount -Identity TestMSA
klist.exe -lh 0 -li 0x3e7 purge ( can be used for reboot option, computer should be rebooted after adding computer in group)
Reset-ADServiceAccountPassword -Identity ServiceAccount1 ( Password can be reset for MSA only from the server where it was installed)
This command is used to check which servers are allowed to use the managed service account :
get-adserviceaccount sMSA_Server05 -properties Name, HostComputers | Select-Object Name, HostComputers
This command display the interval (in days) after which its password is automatically reset if output is blank it is considered 30 days by default :
get-adserviceaccount sMSA_Server05 -properties Name, ManagedPasswordIntervalInDays | Select-Object Name, ManagedPasswordIntervalInDays
This command display the type of the account like MSA or gMSA :
get-adserviceaccount sMSA_Server05 -properties Name, ObjectCategory | Select-Object Name, ObjectCategory
Please note that gMSA will not work on 2008 R2. It only works on 2012 and above