I created a managed service account (not a gMSA) and installed it on a 2012 server with Install-ADServiceAccount.

Now I want to be able to check where my MSA are installed (throughout the domain)

Looking at the MSAs attributes I don't see the server name anywhere.

Looking at the server's attributes I see the service account under msDS-HostServiceAccount.

Would searching for the msDS-HostServiceAccount attribute of computer accounts be the correct way of keeping track of where MSAs are installed?


Using get-ADServiceAccount there is an attribute for hostComputers:

Get-ADServiceAccount -Filter {HostComputers -eq "CN=SQL-Server-1, DC=contoso,DC=com" }

Enabled : True Name : service1

UserPrincipalName :

SamAccountName : service1$

ObjectClass : msDS-ManagedServiceAccount

SID : S-1-5-21-159507390-2980359153-3438059098-29770

ObjectGUID : eaa435ee-6ebc-44dd-b4b6-dc1bb5bcd23a

HostComputers : {CN=SQL-Server-1, DC=contoso,DC=com}

DistinguishedName : CN=service1,CN=Managed Service Accounts,DC=contoso,DC=com

Ref: https://technet.microsoft.com/en-us/library/ee617204.aspx?f=255&MSPPError=-2147217396

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.