With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The bulletin references KB256345 as workaround using the "legacy" method of configuring Windows Services using Group Policy. But as far as I know, that method only allows you to set the security ACLs on the service (and it's startup type)...not the account the service runs as. I'd love to be proven wrong though.

What other ways exist to configure a service to run as a particular domain service account using group policy? We can't just start touching all of these machines by hand to configure the service. Assume for the moment that we have no other Windows based configuration management tools to use and we're stuck with group policy and whatever other built-in tools are available like Powershell.

For the time being in our environment, we've simply blocked the patch in WSUS. But I'm looking for a long term solution. The passwords we're configuring in this manner are all low privilege accounts that don't matter if their passwords are compromised.

Is there perhaps a solution utilizing managed service accounts? Should we come up with some sort of powershell based solution that runs at startup? The GPOs we're using apply to groups of computers that don't all have the service installed. So ideally, this solution won't start spamming the event log with group policy errors

  • Excellent question. However, is there a reason that these services must be run as a domain user, rather than being converted to use a builtin-local account? And if so, is there a reason you must manage these service with GPO/GPP, and not a script? (I'm having trouble thinking of a reason you couldn't achieve the same end with a script + WinRM or PSremoting, for example, though granted it's a bit more pain, from a management perspective.) – HopelessN00b Jul 3 '14 at 0:04
  • So they have to be domain accounts because the services are accessing external resources that require domain authentication/authorization. A script that configures the services is certainly not out of the question, but would ideally be deployable via group policy. The idea is that new hosts are added somewhat regularly and we'd like group policy to automatically configure the services on the hosts once they exist rather than needing to kick off a manual process. – Ryan Bolger Jul 3 '14 at 0:15
  • 1
    In that case, I would a GPO that deploys a script to configure the services (as a Run Once task, as a startup script, as a scheduled task, etc... lots of options there), or if possible, use PowerShell Desired State Configuration + Service Management Automation. – HopelessN00b Jul 3 '14 at 0:22
  • That was pretty much going to be what I fell back on if nothing else looked more...elegant. Powershell DSC looks fun though. I'll definitely look into that. I'm also now looking at the gMSAs introduced with 2012. Though I'm finding conflicting information as to whether pre-2012 OSes support using them. – Ryan Bolger Jul 3 '14 at 4:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.