How to configure GPOADmin to use a Group Managed Service Account (GMSA) ? (4285897)

Chat now with support

Zurück

Feedback übermittelt

Konnten Sie mithilfe dieses Artikels ein Problem lösen?

Bewertung auswählen

Lösung

1	Create a Global security group and add the computers that will host the GPOADmin service.

2	Create the Group Managed Service Account for GPOADmin using the New-ADServiceAccount PowerShell command. For more details, see https://docs.microsoft.com/en-us/powershell/module/activedirectory/new-adserviceaccount?view=windowsserver2019-ps.


	NOTE: The GMSA will not update the SPN automatically each time the service starts resulting in warnings in the GPOADmin event log. To prevent the service from updating the SPN, add the following to the registry of the GPOADmin service host if it does not exist: Value name: UpdateSPN Value type: DWORD Value path: HKEY_LOCAL_MACHINE\SOFTWARE\Quest\GPOADmin\ServerConfig Value: 0

3	Create a global security group and add the Group Managed Service Account. This security group will be used to grant permission to the service account.

4	For each computer that will host the GPOADmin service and that you added to the security group in step 2, do the following:

a	Restart the computer.

b	Run the following PowerShell command once the GPOADmin host computers have restarted to install the GMSA: Install-ADServiceAccount -Identity <service_account_name>.

c	Run the following PowerShell command to verify that the GMSA was successfully installed. The command will return True if the GMSA was successfully installed: Test-ADServiceAccount -Identity <service_account_name>.

5	Follow the Minimum permissions required for the service accounts and replace the service account with the group the GMSA member of create in step 4.


	NOTE: If configuring for SQL, enter the actual GMSA instead of the group when specifying a windows login.

Feedback übermittelt

Konnten Sie mithilfe dieses Artikels ein Problem lösen?

Bewertung auswählen

Empfohlener Inhalt