Chat now with support

Live-Hilfe anfordern
Registrierung abschließen

Anmelden

Preisinformationen anfragen

Vertrieb kontaktieren

How to configure GPOADmin to use a Group Managed Service Account (GMSA) ? (4285897)

Zurück

Feedback übermittelt

Konnten Sie mithilfe dieses Artikels ein Problem lösen?

Bewertung auswählen

Titel

How to configure GPOADmin to use a Group Managed Service Account (GMSA) ?
Beschreibung

The following steps can be use to configure a GMSA on GPOADmin

Lösung

To configure GPOADmin to use a Group Managed Service Account

1	Create the Key Distribution Services KDS Root Key. For details, see https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj128430(v=ws.11)?redirectedfrom=MSDN.

2	Create a Global security group and add the computers that will host the GPOADmin service.

3	Create the Group Managed Service Account for GPOADmin using the New-ADServiceAccount PowerShell command. For more details, see https://docs.microsoft.com/en-us/powershell/module/addsadministration/new-adserviceaccount?view=win10-ps.

Set the -PrincipalsAllowedToRetrieveManagedPassword switch to specify the name of the global security group created in step 2.

Set the -ServicePrincipalNames switch for the default domain unique SPN. For example. to ‘GPOADmin/GPOADminService/domainxyz.microsoft.com'.

If you require multiple service accounts, set the value to 'GPOADmin/server.domain.com:port#'. For example, GPOADmin/DC1.domain.com:40200. See Managing client connections for more information.


	NOTE: The GMSA will not update the SPN automatically each time the service starts resulting in warnings in the GPOADmin event log. To prevent the service from updating the SPN, add the following to the registry of the GPOADmin service host if it does not exist: Value name: UpdateSPN Value type: DWORD Value path: HKEY_LOCAL_MACHINE\SOFTWARE\Quest\GPOADmin\ServerConfig Value: 0

4	Create a global security group and add the Group Managed Service Account. This security group will be used to grant permission to the service account.

5	Add the security group as a member to the Group Policy Creator Owners group.

6	For each computer that will host the GPOADmin service and that you added to the security group in step 2, do the following:

a	Restart the computer.

b	Run the following PowerShell command once the GPOADmin host computers have restarted to install the GMSA: Install-ADServiceAccount -Identity <service_account_name>.

c	Run the following PowerShell command to verify that the GMSA was successfully installed. The command will return True if the GMSA was successfully installed: Test-ADServiceAccount -Identity <service_account_name>.

7	Follow the Minimum permissions required for the service accounts and replace the service account with the group the GMSA member of create in step 4.


	NOTE: If configuring for SQL, enter the actual GMSA instead of the group when specifying a windows login.

The GPOADmin installer does not currently allow the selection of GMSAs when selecting the service account. Select an existing user account for the installation process.

Once GPOADmin is installed, you can set the service account as the GMSA created above. To do so:

a	Open the Service Control Manager and locate the GPOADmin Service.

b	Right-click and select Properties.

c	On the Log On tab, select This account, and click the Browse button.

d	Enter the GMSA name and click OK.

e	Clear the password fields and click OK.

Once the service is using a GMSA account, select the password from the LSA. This will disable the ability to stop the service or change the service account.

You can run the following command to switch back to a normal account:

sc <server> managedaccount [service name] [type]. For example, sc managedaccount "QGPMService" false.

Feedback übermittelt

Konnten Sie mithilfe dieses Artikels ein Problem lösen?

Bewertung auswählen

Request a KB Article

Leave a Comment

Empfohlener Inhalt

Produkt(e):: GPOADmin
5.17, 5.16, 5.15, 5.14

Thema/Themen:: How To

Artikelhistorie:: Erstellt am: 8/11/2020
Letzte Aktualisierung am: 5/7/2023

Alle Artikel durchsuchen

© ALL RIGHTS RESERVED. Feedback Nutzungsbedingungen Datenschutz Cookie Preference Center