GMSA guide

Group Managed Service Accounts is a managed domain account that securely runs services, applications, and scheduler jobs. This special type of Active Directory accounts provides automatic password management, the ability to delegate control to other administrators, and simplified service principal name (SPN) management.

For the first time, this feature appeared in Windows Server 2008 R2 and Windows 7, it also provides the same functionality in the domain, but also extends the functionality to multiple servers. If the GMSA is used as a service principal, the Windows operating system will manage the account password and will not rely on an administrator to manage the password.

Creation

Before wondering how to create a GMSA, there are a few prerequisites to know and do.

• Group Managed Service Accounts can only be configured on hosts running Windows Server 2012 or later because gMSA passwords can only be propagated by domain controllers running Windows Server 2012 or later.

• In order to create a gMSA account, you must be a domain administrator or use an account with "Create MSDS-GroupManagedServiceAccount Object" permission.

• You should also download the CredentialSpec PowerShell module, you can save the module on a computer with Internet access and copy it to your development computer.

Once these conditions are met, you can create a GMSA.

When you create a GMSA, you create a common identifier to use it simultaneously on different machines. As stated above, Active Directory owns access to the GMSA password, so it is recommended that you create a security group for each GMSA account. Next, you need to add associated container hosts to this security group in order to thus restrict access to passwords.

In addition, you need to manually create one or more hostnames for the GMSA account, as the container does not automatically register SPNs. Normally, the host is registered with the same name as the GMSA account, but if the DNS name is different from the name GMSA or the client is accessing the container app from behind the load balancer, you may need to use a different service name.

Once the name is GMSA determined, start PowerShell and create a security group and GMSA.

Use the following commands:

• Install-WindowsFeature RSAT-AD-PowerShell. The command is used to install the module on Windows Server,

• Add-WindowsCapability -Online -Name 'RSAT.ActiveDirectory.DS-LDS.Tools ~~~~ 0.0.1.0'. The command is used to install the module ADon Windows 10, version 1809 or later,

• New-ADGroup -Name "WebApp02 Authorized Hosts" -SamAccountName "WebApp01Hosts" -GroupScope DomainLocal. The command is used to create a security group.

• New-ADServiceAccount -Name "WebApp02" -DnsHostName "WebApp02.contoso.com" -ServicePrincipalNames "host / WebApp01", "host / WebApp02.contoso.com" -PrincipalsAllowedToRetrieveManagedPassword "WebApp01Hosts". The command is used to create GMSA.

• Add-ADGroupMember -Identity "WebApp02Hosts" -Members "ContainerHost01 $", "ContainerHost02 $", "ContainerHost03 $". The command is used to add container hosts to a security group.

Note: Where WebApp02 and contoso.com are your GMSA names and domain names respectively.