Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [managed-service-accounts]

The tag has no usage guidance.

3
votes
1answer
124 views

Install Service Account remotely to lots of servers

We have a new process I'm trying to implement, part one of my task basically is change the local administrator password every month and update the password vault with the new password for the ...
0
votes
0answers
117 views

Task scheduler fails to run task under group managed service account

I successfully followed the detailed instructions in this Technet blog post on setting up a group managed service account called 'locSchedAccount' on a Windows Server 2016 Standard machine acting as ...
3
votes
0answers
36 views

Install Windows Service using chef and have it run using a Group Managed Service Account

I'm trying to setup a number of dev servers using Chef. I need a Windows Service to run as a managed service account. I have the following in a recipe: windows_service 'My Windows Service' do ...
0
votes
1answer
159 views

SQL Server with MSA cannot write to UNC share

I have SQL Server 2012 running in an Active Directory Domain environment. I set up a Managed Service Account for the SQL services to run under, as per this document. Since my domain functional level ...
4
votes
1answer
325 views

How can I get a Managed Service Account to use internet proxy settings from Group Policy?

I have a service running on a Windows 2012 R2 domain member server that requires internet access. The service is configured to run under a Managed Service Account and the account is granted local ...
1
vote
1answer
98 views

Remove AD PS Module after installing gMSA on Windows Server 2012 R2

I installed a Group Managed Service Account on a Windows 2012 R2 Server. In doing so, I had to install the Active Directory module for Windows PowerShell Feature. Is it possible to uninstall that ...
1
vote
1answer
1k views

How to find owner of a aws account with account number

I inherited a couple of AWS environments. I have been recently doing security audits of s3 and found several policies with principals containing aws account numbers I don't know and nobody at my ...
2
votes
0answers
95 views

Can I as a normal user run stuff under a managed service account?

Let's say I have remote access to a server which uses MSA's to run application pools and windows services. Can I as a normal (not elevated) user run program's under those MSA's? For example PsExec....
1
vote
0answers
302 views

IIS App Pool won't start with gMSA identity if it is first used after the number of days in msDS-ManagedPasswordInterval

We have been using Group Managed Service Accounts (gMSAs) in our environment without issues until recently. We deployed several apps to production where the gMSAs had been created about 60 days ago ...
0
votes
0answers
654 views

Schedule Windows Task with Managed Service Account on DC

I have downloaded a script from TechNet and i am scheduling this with the MSA(Manage Service Account) on a DC. I get the error Task Scheduler launched "{!@#!#!@#}" instance of task "\TasknamE" for ...
3
votes
1answer
1k views

Does a Managed Service Account require a domain?

Does a Managed Service Account require a domain? I am trying to setup a standalone server (no domain) to add managed service accounts to assign for running services instead of creating local user ...
2
votes
1answer
512 views

Group Managed Service Accounts per service per server (Best practice?) and long names?

I've talked with a few colleagues about what might be best practice for using group managed service accounts in our environment. It seems that ideally, we would create 1 gMSA per service (e.g. SQL ...
4
votes
1answer
311 views

Giving permissions to Virtual Service Accounts on domain controllers

The service I'm implementing will run on a domain controller, so I'd like it to have minimal privileges. Ideally, it would simply run as Local Service. However, it needs to be able to: monitor ...
0
votes
1answer
54 views

Added SQL Server 2008 R2 to domain, can't send email

I had a standalone machine running SQL Server 2008 R2 that I joined to a domain. I set up an MSA and set all of the SQL services to log in under it. I can access the DB remotely and run queries, but ...
5
votes
1answer
880 views

How to tell when a managed service account password last changed

We have a managed service account running a service on a Windows 2012 R2 service. The service has a pattern of failing every 30 or 60 days (sometimes 30 days, sometimes 60 days). One thought we had ...
2
votes
1answer
709 views

Using group managed service accounts on OS version < Windows 2012

Trying to leverage benefit of Group-Managed Service Accounts (gMSA) but have a mixed environment. My guide was this blog post: https://blogs.technet.microsoft.com/askpfeplat/2012/12/16/windows-server-...
6
votes
2answers
6k views

Run command with a Managed Service Account?

I've just granted permissions for a MSA (Managed Service Account) to some resources. Can I verify it works, by running a cmd.exe process with the credentials of the MSA account, and check I have the ...
5
votes
0answers
877 views

How do I fix a non-starting “Microsoft Key Distribution Service”? (not to be confused with Kerberos KDS)

The Microsoft Key Distribution Service is not starting on my DC (kdssvc.dll) and when I look at the event log under Microsoft\Kdssvc, I see the events: Event ID 4001 Group Key Distribution ...
1
vote
2answers
4k views

Group Managed Service Accounts: -PrincipalsAllowedToRetrieveManagedPassword

So the documentation for creating gMSAs says that the parameter "-PrincipalsAllowedToRetrieveManagedPassword" should restrict the ability of using the gMSA to the machines that are part of the ...
2
votes
0answers
916 views

How does one create a certificate request for a managed service account in Windows?

I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the "...
5
votes
0answers
422 views

Installing MSA (Managed Service Accounts) using Windows deployment tools

I have to install several new application servers (2012R2) for a project which will run IIS and MSMQ. I need to script the complete install, so I need to be able to change permissions on IIS ...
1
vote
0answers
824 views

SQL Server 2012 permissions from AD group login not refreshed until server restart

We have some IIS sites which runs under Managed Service Accounts (Windows Server 2012). Theese MSAs are members of resource groups in Active Directory. We are using resource groups as logins in SQL ...