Questions tagged [managed-service-accounts]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
52 views

How to run application under secondary GMSA in Docker container?

The Microsoft documentation about creating GMSA's for Docker containers reads: Containers can also be configured with additional gMSAs, in case you want to run a service or application in the ...
Leonard de Ruijter's user avatar
2 votes
1 answer
1k views

gMSA and Read Only Domain Controllers

Windows Server 2019 Environment I have 2 writable DCs and 1 RODC out in a DMZ that will all need to use a gMSA for some software we are deploying. This is my first time ever making use of gMSAs / ...
The ITea Guy's user avatar
0 votes
1 answer
687 views

Allow interactive login for group managed service account (gMSA)

I'm trying to troubleshoot an issue with a gMSA and the error is displayed interactively. psexec is blocked by sophos, which is quite a hasle to whitelist (would be the sure way to get an interactive ...
user189695's user avatar
2 votes
1 answer
2k views

Removing MediaAdmin and ServerAdmin managed server accounts in Active Directory

Our Active Directory Domain contains two Managed Service Accounts, MediaAdmin and ServerAdmin: I don't remember adding them, and Google tells me that they are related to the Windows Server Essentials ...
Heinzi's user avatar
  • 2,237
1 vote
1 answer
4k views

Difference between Managed Service Account and Non Interactive Server Account in AD

Just out of Curiosity also I couldn't find the answers to this anywhere, I am learning AD LDAP and came across a scenario for using non interactive service account for binding LDAP. I am not able to ...
user avatar
0 votes
1 answer
2k views

How to use gMSA account with Task Scheduler and Powershell to manage DHCP filters

I am struggling to keep DHCP filters in sync between multiple DHCP servers, each of them is running on a domain controller. I wrote a simple script to get filters from master DHCP server and push them ...
wilk's user avatar
  • 1
2 votes
0 answers
2k views

Group Managed Service Account access to network share on remote server

We've got a service running using a Group Managed Service Account on a Windows Server 2016 host (HostA). We're extending the functionality of this service so that it runs an R script which needs to ...
Stuart's user avatar
  • 141
1 vote
1 answer
1k views

Group Managed Service Accounts (GMSA) and Read-Only Domain Controllers (RODC)

We have RODC in a DMZ site and we would like to use GMSA, but the problem is that since domain controllers are read-only, it seems that I have to set a password at the creation of a new account such ...
user avatar
1 vote
1 answer
3k views

Running powershell as service account without logon privilege

I'm trying to run a powershell script as a service account via task scheduler. It has to run as the service account (rather than the local system) to get required permissions to do some of the tasks. ...
user3129594's user avatar
0 votes
1 answer
151 views

Group Managed Service Account - Permanent Password?

Is there a way to manually manage gMSA (Group Managed Service Account) passwords? Usually gMSA passwords are managed by Active Directory, but sometimes I need to manually manage the password (to use ...
GKman's user avatar
  • 495
0 votes
0 answers
252 views

IIS Worker doesn't run or crashes immediately

We have an IIS app hosted on Windows 2016 Server which runs fine, when running as Local User or Network Service. One of the customers is setting up the application to run on a Service Account (...
Ranganathan's user avatar
0 votes
1 answer
281 views

Can I run mongodb under a Managed Service Account

I'm trying to run MongoDB under a Windows Managed Service Account. This works fine for memcached on the same server, but when I run the MongoDB account I get this: Windows could not start the MongoDB ...
Macke's user avatar
  • 53
0 votes
0 answers
396 views

Can a gMSA be used with Centralized Certificates?

I'm planning a rollout of IIS Centralized Certificates (on Windows 2016 servers), and attempting to determine if this would support a Group Managed Service account, or if I have to go with a regular ...
Ross Presser's user avatar
0 votes
2 answers
451 views

Managed hosting, VPS & RAM - Virtual Memory?

I'm talking to a web host that's just starting up. They have shared hosting and managed VPS's. With shared hosting I understand that they have a script checking if a process goes over memory limits ...
Diagon's user avatar
  • 246
2 votes
1 answer
3k views

Does Install-ADSericeAccount modify "NT SERVICE\ALL SERVICES"

I had a problem where newly created Managed Service Accounts did not have "Logon as a service" right. A GPO was excluding "NT SERVICE\ALL SERVICES" from "Logon as a service". This was fixed. Am I ...
leancz's user avatar
  • 152
2 votes
0 answers
2k views

Can I use a gMSA for stored credentials in a SSRS data source?

I have an instance of SQL Server 2016 Reporting Services service running under DOMAIN\reporting$ containing a data source that needs to query a database using the stored credential DOMAIN\database$. ...
Mike's user avatar
  • 1,293
4 votes
1 answer
4k views

Install Service Account remotely to lots of servers

We have a new process I'm trying to implement, part one of my task basically is change the local administrator password every month and update the password vault with the new password for the ...
Pavle Stojanovic's user avatar
3 votes
0 answers
326 views

Install Windows Service using chef and have it run using a Group Managed Service Account

I'm trying to setup a number of dev servers using Chef. I need a Windows Service to run as a managed service account. I have the following in a recipe: windows_service 'My Windows Service' do ...
Greg's user avatar
  • 463
0 votes
1 answer
2k views

SQL Server with MSA cannot write to UNC share

I have SQL Server 2012 running in an Active Directory Domain environment. I set up a Managed Service Account for the SQL services to run under, as per this document. Since my domain functional level ...
Charles Burge's user avatar
5 votes
1 answer
3k views

How can I get a Managed Service Account to use internet proxy settings from Group Policy?

I have a service running on a Windows 2012 R2 domain member server that requires internet access. The service is configured to run under a Managed Service Account and the account is granted local ...
Earl Sven's user avatar
  • 187
1 vote
1 answer
291 views

Remove AD PS Module after installing gMSA on Windows Server 2012 R2

I installed a Group Managed Service Account on a Windows 2012 R2 Server. In doing so, I had to install the Active Directory module for Windows PowerShell Feature. Is it possible to uninstall that ...
bg818969's user avatar
2 votes
2 answers
8k views

How to find owner of a aws account with account number

I inherited a couple of AWS environments. I have been recently doing security audits of s3 and found several policies with principals containing aws account numbers I don't know and nobody at my ...
user176373's user avatar
2 votes
0 answers
1k views

Can I as a normal user run stuff under a managed service account?

Let's say I have remote access to a server which uses MSA's to run application pools and windows services. Can I as a normal (not elevated) user run program's under those MSA's? For example PsExec....
Martijn B's user avatar
  • 121
1 vote
0 answers
1k views

IIS App Pool won't start with gMSA identity if it is first used after the number of days in msDS-ManagedPasswordInterval

We have been using Group Managed Service Accounts (gMSAs) in our environment without issues until recently. We deployed several apps to production where the gMSAs had been created about 60 days ago ...
jhiller's user avatar
  • 161
1 vote
1 answer
3k views

Schedule Windows Task with Managed Service Account on DC

I have downloaded a script from TechNet and i am scheduling this with the MSA(Manage Service Account) on a DC. I get the error Task Scheduler launched "{!@#!#!@#}" instance of task "\TasknamE" for ...
Pasha's user avatar
  • 243
5 votes
1 answer
2k views

Does a Managed Service Account require a domain?

Does a Managed Service Account require a domain? I am trying to setup a standalone server (no domain) to add managed service accounts to assign for running services instead of creating local user ...
jcolebrand's user avatar
3 votes
1 answer
1k views

Group Managed Service Accounts per service per server (Best practice?) and long names?

I've talked with a few colleagues about what might be best practice for using group managed service accounts in our environment. It seems that ideally, we would create 1 gMSA per service (e.g. SQL ...
Michael's user avatar
  • 141
4 votes
1 answer
887 views

Giving permissions to Virtual Service Accounts on domain controllers

The service I'm implementing will run on a domain controller, so I'd like it to have minimal privileges. Ideally, it would simply run as Local Service. However, it needs to be able to: monitor ...
YaronK's user avatar
  • 141
0 votes
1 answer
160 views

Added SQL Server 2008 R2 to domain, can't send email

I had a standalone machine running SQL Server 2008 R2 that I joined to a domain. I set up an MSA and set all of the SQL services to log in under it. I can access the DB remotely and run queries, but ...
grumble's user avatar
  • 35
5 votes
1 answer
4k views

How to tell when a managed service account password last changed

We have a managed service account running a service on a Windows 2012 R2 service. The service has a pattern of failing every 30 or 60 days (sometimes 30 days, sometimes 60 days). One thought we had ...
Greg's user avatar
  • 463
2 votes
1 answer
1k views

Using group managed service accounts on OS version < Windows 2012

Trying to leverage benefit of Group-Managed Service Accounts (gMSA) but have a mixed environment. My guide was this blog post: https://blogs.technet.microsoft.com/askpfeplat/2012/12/16/windows-server-...
ColPanic's user avatar
12 votes
2 answers
34k views

Run command with a Managed Service Account?

I've just granted permissions for a MSA (Managed Service Account) to some resources. Can I verify it works, by running a cmd.exe process with the credentials of the MSA account, and check I have the ...
iTayb's user avatar
  • 791
5 votes
1 answer
4k views

How do I fix a non-starting "Microsoft Key Distribution Service"? (not to be confused with Kerberos KDS)

The Microsoft Key Distribution Service is not starting on my DC (kdssvc.dll) and when I look at the event log under Microsoft\Kdssvc, I see the events: Event ID 4001 Group Key Distribution ...
makerofthings7's user avatar
2 votes
2 answers
12k views

Group Managed Service Accounts: -PrincipalsAllowedToRetrieveManagedPassword

So the documentation for creating gMSAs says that the parameter "-PrincipalsAllowedToRetrieveManagedPassword" should restrict the ability of using the gMSA to the machines that are part of the ...
dsa's user avatar
  • 21
2 votes
0 answers
2k views

How does one create a certificate request for a managed service account in Windows?

I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the "...
bshacklett's user avatar
  • 1,388
5 votes
0 answers
647 views

Installing MSA (Managed Service Accounts) using Windows deployment tools

I have to install several new application servers (2012R2) for a project which will run IIS and MSMQ. I need to script the complete install, so I need to be able to change permissions on IIS ...
Xenophane's user avatar