What is the supported way to check where my managed service accounts are installed?

Question

I created a managed service account (not a gMSA) and installed it on a 2012 server with Install-ADServiceAccount.

Now I want to be able to check where my MSA are installed (throughout the domain)

Looking at the MSAs attributes I don't see the server name anywhere.

Looking at the server's attributes I see the service account under msDS-HostServiceAccount.

Would searching for the msDS-HostServiceAccount attribute of computer accounts be the correct way of keeping track of where MSAs are installed?

Answer 1

Using get-ADServiceAccount there is an attribute for hostComputers:

Get-ADServiceAccount -Filter {HostComputers -eq "CN=SQL-Server-1, DC=contoso,DC=com" }

Enabled : True Name : service1

UserPrincipalName :

SamAccountName : service1$

ObjectClass : msDS-ManagedServiceAccount

SID : S-1-5-21-159507390-2980359153-3438059098-29770

ObjectGUID : eaa435ee-6ebc-44dd-b4b6-dc1bb5bcd23a

HostComputers : {CN=SQL-Server-1, DC=contoso,DC=com}

DistinguishedName : CN=service1,CN=Managed Service Accounts,DC=contoso,DC=com

Ref: https://technet.microsoft.com/en-us/library/ee617204.aspx?f=255&MSPPError=-2147217396