Find out about Managed Group Services Accounts in Windows Server 2012

on



Managed Service Accounts (MSA) - Managed Service Account - was introduced in Windows Server 2008 R2 to automatically manage (or change) the passwords of service accounts. Using MSA, you can significantly reduce the risk of the system account running compromised services. The MSA has a major weakness that is only usable on a computer. It means that MSA service accounts cannot work with NLB service groups (operate simultaneously on multiple servers and use the same account and password). To fix this, Microsoft added Group Managed Service Accounts (gMSA) - a managed managed service account to Windows Server 2012.

To create a gMSA, follow the steps below

Step 1 - Create a KDS Root Key using the KDS service on DC to create a password.

Tạo KDS Root Key

To use the key immediately in the test environment, you can run the PowerShell command:

Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10))

To check if it successfully created, run the PowerShell command:

Get-KdsRootKey

Step 2 - To create and configure gMSA → Open Powershell terminal and type:

New – ADServiceAccount – name gmsa1 – DNSHostNamedc1.example.com – PrincipalsAllowedToRetrieveManagedPassword "gmsa1Group"

Inside,

  • gmsa1 is the name of the created gMSA account.
  • dc1.example.com is the DNS server name.
  • gmsa1Group is the active directory group, including all used systems. This group must be pre-created in Groups.

Để kiểm tra, vào Server Manager → Tools → Active Directory Users and Computers → Managed Service Accounts.

Check account creation

Step 3 - To install gMA on the server → open PowerShell terminal and type the following commands:

The result will show "True" after running the second command, as shown in the screenshot given below:

Results displayed

Step 4 - Go to Service properties, specify that the service will be run with gMSA account. In the This account box in the Log on tab, enter the service account name. At the end of the name type the additional symbol $, you may not need to enter the password. After the change is saved, restart the service.

Enter the service account name

The account will receive the message "Log On as a Service" and the password will be automatically retrieved.

See more:




Comments

Post a Comment