Find Out About Managed Group Services Accounts in Windows Server

This updated guide examines Find Out About Managed Group Services Accounts in Windows Server and organizes the essential facts, background, and practical takeaways in clear American English.

To create a gMSA, follow the steps below

Step 1 - Create a KDS Root Key using the KDS service on DC to create a password.

To use the key immediately in the test environment, you can run the PowerShell command:

Add-KdsRootKey -EffectiveTime ((get-date).addhours (-10))

To check if it successfully created, run the PowerShell command:

Get-KdsRootKey

Step 2 - To create and configure gMSA ? Open Powershell terminal and type:

New - ADServiceAccount - name gmsa1 - DNSHostNamedc1.example.com - PrincipalsAllowedToRetrieveManagedPassword "gmsa1Group"

Inside,

• gmsa1 is the name of the created gMSA account.
• dc1.example.com is the DNS server name.
• gmsa1Group is an active directory group, including all used systems. This group must be pre-created in Groups .

To check, go to Server Manager ? Tools ? Active Directory Users and Computers ? Managed Service Accounts .

Step 3 - To install gMA on the server ? open PowerShell terminal and type the following commands:

• Install - ADServiceAccount - Identity gmsa1

• Test - ADServiceAccount gmsa1

The result will show " True " after running the second command, as shown in the screenshot given below:

Step 4 - Go to Service properties , specify that the service will be run with gMSA account. In the This account box in the Log on tab, enter the service account name. At the end of the name type the additional symbol $ , you may not need to enter the password. After the change is saved, restart the service.

The account will receive the message ' Log On as a Service ' and the password will be automatically retrieved.

:

• Instructions for installing Windows Server 2012 step by step
• 6 ways to access Control Panel on Windows Server 2012
• Instructions for setting F8 key to start Windows 8 in Safe Mode