I'm trying to solve a conundrum for my DBAs and developers. We have an application that is running under a gMSA (group managed service account) identity. This application needs to access a SQL database, and we prefer to grant access by using groups whenever possible. However, when adding the gMSA to a security group that has access to the DB, SQL Server is unable to resolve the account as a member of the group. Here's the kicker: when the gMSA is added directly to the DB permissions, it works flawlessly. Are there any restrictions around nesting gMSAs in security groups that I am not aware of?

  • Has the gMSA logged off and logged back on again since the group membership change? – Semicolon Jun 4 at 18:40
  • I don't know. Is the AD group marked as a security group? Also, can you talk more about there preference to Grange permissions to groups? Like, could you accomplish a similar thing by using roles in the database? – Ben Thul Jun 7 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.