3

I recently set up a group managed service account to ditch the headache of password rotation. The account creation went smoothly. I was able to set up a service to run as the gMSA, and the account was given "Log on as a service" privileges. I also have some scheduled tasks I need to convert, but whenever I try to grant "Log on as a batch service" or "Create symlinks" privileges (via secpol.msc) to the account I get the following error:

"An extended error has occurred. Failed to save Local Policy Database."

I have tried this on several machines, all with the same result. Is this supposed to be possible, and if so, any suggestions on where to start digging for solutions? All servers are Windows Server 2012 R2 SP0.

Thanks in advance.

Improve this question

1 Answer 1

Reset to default
2

Yes, Group Managed Service Accounts can indeed be granted "Log on as a batch job" and "Log on as a service" rights, among others.

From the MS PFE blog:

gMSA

gMSA

In fact just go ahead and check out the entire post:

http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx

Make sure you're specifying the dollar sign in the name as shown.

Improve this answer
3
  • I visited that link previously when setting up the gMSA. As you say, these permissions should be settable, but I get the same error on all of my machines when I try to do so. The fact that all of my machines are impacted is what gave me doubts. I have been unable to find anything to explain why this doesn't work.
    – Peter Friend
    Mar 17, 2015 at 15:34
  • 1
    Hmm. I suspect a bug. Try using a command line tool, such as ntrights +r SeBatchLogonRight -u "SERVER\GMSA$" instead of the GUI.
    – Ryan Ries
    Mar 17, 2015 at 15:55
  • 1
    That worked Ryan. The ntrights utility was able to set these permissions. Log on as a service showed up because the services UI is able to handle gMSA, and added that permission automatically. Secpol.msc doesn't work with these accounts at all. I'll try to find the right team to file a bug against.
    – Peter Friend
    Mar 18, 2015 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.