gMSA and SQL Server

 Overview for gMSA - see in this post.

gMSA and SQL Server

 A single gMSA can be shared across multiple SQL Server hosts.
It helps to manage the service accounts in environments with a large number of SQL Server instances, without compromise on security issues.
Any update to an MSA password does not require a restart of SQL Server.
gMSA can be very interesting for an availability group environment

• The main point of gMSA for AG is the setup of one managed service account for all replicas.

• All instances in AG should be in the gMSA group.

• gMSA for AG is only supported from SQL Server 2016.

Connecting gMSA with SQL Server
A connection between SQL Server to gMSA is created by assigning the gMSA account to the SQL Server service.
The connection is done:

• For a new installation: During the SQL Server installation you specify the gMSA account.

• For an existing SQL Server instance: changing the existing SQL Server instance to use a gMSA is done with the SQL Server Configuration Manager (SSCM) tool.

gMSA requirements
gMSA requirements - see here.

Additional requirements for gMSA for SQL Server:

SQL Server 2014 and above

SQL Server support for gMSA when running on Windows Server 2012 R2 and above.

Domain Functional Level of 2012 or higher.

Active Directory PowerShell module installed.

Useful links

Using Group Managed Service Accounts with SQL Server

Configure the SQL Server instance to use the gMSA

Managed Service Accounts with SQL Server

Using a gMSA with SQL Server

gMSA - Group Managed Service Account

Overview

Standalone MSA (Managed Service Account) is a type of managed domain account created and managed by the domain controller:

• It’s assigned to a single member computer for use running a service.

• The password is managed automatically by the domain controller.

• You cannot use a MSA to log into a computer, but a computer can use a MSA to start a Windows service.

• including delegation of management to other administrators.

gMSA (Group Managed Service Account) is the same as MSA but for a group:

• A group = multiple servers.

• Windows manages a service account for services running on a group of servers.

• gMSA provide a single identity solution for services running on a server farm, or on systems behind Network Load Balance.

• Active Directory automatically updates the group managed service account password without restarting services.

• The service accounts can be used for scheduled tasks, IIS application pools, SQL Server and Microsoft Exchange.

• Because gMSA can be used with multiple machines, it allows you the flexibility to be able to implement Network Load Balancing (NLB). NLB allows you to group together servers and operate as one single system.

Windows PowerShell commands are used to administer gMSA.

gMSA requirements

Windows Server 2012 and above.

A 64-bit architecture (required to run the PowerShell commands).

Domain Functional Level of 2012 or higher.

A Key Distribution Service root key (KDS root key) has to be created and 10 hours are required for it to be replicated on all domain controllers.

Useful links

Microsoft: Configure Windows Service Accounts and Permissions (--> Managed Service Accounts, Group Managed Service Accounts, and Virtual Accounts)

Microsoft: Group Managed Service Accounts Overview

Getting Started with Group Managed Service Accounts (for gMSA requirements).

Creating and Associating A Group Managed Service Account

Step-by-Step Guide to work with gMSA - PowerShell Guide