Find out about Managed Group Services Accounts in Windows Server 2012

Managed Service Accounts (MSA) - Managed Service Account - was introduced in Windows Server 2008 R2 to automatically manage (or change) the passwords of service accounts. Using MSA, you can significantly reduce the risk of the system account running the compromised services. The MSA has a major weakness that is only usable on a computer. It means that MSA service accounts cannot work with NLB service groups (operate simultaneously on multiple servers and use the same account and password). To fix this, Microsoft added Group Managed Service Accounts (gMSA) - a managed managed service account to Windows Server 2012.

To create a gMSA, follow the steps below

Step 1 - Create a KDS Root Key using the KDS service on DC to create a password.

Find out about Managed Group Services Accounts in Windows Server 2012 Picture 1

To use the key immediately in the test environment, you can run the PowerShell command:

 Add-KdsRootKey -EffectiveTime ((get-date) .addhours (-10)) 

To check if it successfully created, run the PowerShell command:

 Get-KdsRootKey 

Step 2 - To create and configure gMSA → Open Powershell terminal and type:

New - ADServiceAccount - name gmsa1 - DNSHostNamedc1.example.com - PrincipalsAllowedToRetrieveManagedPassword "gmsa1Group"

Inside,

1. gmsa1 is the name of the created gMSA account.
2. dc1.example.com is the DNS server name.
3. gmsa1Group is an active directory group, including all used systems. This group must be pre-created in Groups .

To check, go to Server Manager → Tools → Active Directory Users and Computers → Managed Service Accounts .

Find out about Managed Group Services Accounts in Windows Server 2012 Picture 2

Step 3 - To install gMA on the server → open PowerShell terminal and type the following commands:

1.  Install - ADServiceAccount - Identity gmsa1 

2.  Test - ADServiceAccount gmsa1 

The result will show " True " after running the second command, as shown in the screenshot given below:

Find out about Managed Group Services Accounts in Windows Server 2012 Picture 3

Step 4 - Go to Service properties , specify that the service will be run with gMSA account. In the This account box in the Log on tab, enter the service account name. At the end of the name type the additional symbol $ , you may not need to enter the password. After the change is saved, restart the service.

Find out about Managed Group Services Accounts in Windows Server 2012 Picture 4

The account will receive the message ' Log On as a Service ' and the password will be automatically retrieved.

See more:

1. Instructions for installing Windows Server 2012 step by step
2. 6 ways to access Control Panel on Windows Server 2012
3. Instructions for setting F8 key to start Windows 8 in Safe Mode