gMSA - Group Managed Service Account

Overview

Standalone MSA (Managed Service Account) is a type of managed domain account created and managed by the domain controller:

• It’s assigned to a single member computer for use running a service.

• The password is managed automatically by the domain controller.

• You cannot use a MSA to log into a computer, but a computer can use a MSA to start a Windows service.

• including delegation of management to other administrators.

gMSA (Group Managed Service Account) is the same as MSA but for a group:

• A group = multiple servers.

• Windows manages a service account for services running on a group of servers.

• gMSA provide a single identity solution for services running on a server farm, or on systems behind Network Load Balance.

• Active Directory automatically updates the group managed service account password without restarting services.

• The service accounts can be used for scheduled tasks, IIS application pools, SQL Server and Microsoft Exchange.

• Because gMSA can be used with multiple machines, it allows you the flexibility to be able to implement Network Load Balancing (NLB). NLB allows you to group together servers and operate as one single system.

Windows PowerShell commands are used to administer gMSA.

gMSA requirements

Windows Server 2012 and above.

A 64-bit architecture (required to run the PowerShell commands).

Domain Functional Level of 2012 or higher.

A Key Distribution Service root key (KDS root key) has to be created and 10 hours are required for it to be replicated on all domain controllers.

Useful links

Microsoft: Configure Windows Service Accounts and Permissions (--> Managed Service Accounts, Group Managed Service Accounts, and Virtual Accounts)

Microsoft: Group Managed Service Accounts Overview

Getting Started with Group Managed Service Accounts (for gMSA requirements).

Creating and Associating A Group Managed Service Account

Step-by-Step Guide to work with gMSA - PowerShell Guide