FREE TRIALS

How to configure GPOADmin to use a Group Managed Service Account (GMSA) ? (4285897)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

How to configure GPOADmin to use a Group Managed Service Account (GMSA) ?
Description

The following steps can be use to configure a GMSA on GPOADmin

Resolution

To configure GPOADmin to use a Group Managed Service Account

1	Create a Global security group and add the computers that will host the GPOADmin service.

2	Create the Group Managed Service Account for GPOADmin using the New-ADServiceAccount PowerShell command. For more details, see https://docs.microsoft.com/en-us/powershell/module/activedirectory/new-adserviceaccount?view=windowsserver2019-ps.

Set the -PrincipalsAllowedToRetrieveManagedPassword switch to specify the name of the global security group created in step 2.

Set the -ServicePrincipalNames switch for the default domain unique SPN to 'GPOADmin/server.domain.com:port#'. For example, GPOADmin/DC1.domain.com:40200. See Managing client connections for more information.


	NOTE: The GMSA will not update the SPN automatically each time the service starts resulting in warnings in the GPOADmin event log. To prevent the service from updating the SPN, add the following to the registry of the GPOADmin service host if it does not exist: Value name: UpdateSPN Value type: DWORD Value path: HKEY_LOCAL_MACHINE\SOFTWARE\Quest\GPOADmin\ServerConfig Value: 0

3	Create a global security group and add the Group Managed Service Account. This security group will be used to grant permission to the service account.

4	For each computer that will host the GPOADmin service and that you added to the security group in step 2, do the following:

a	Restart the computer.

b	Run the following PowerShell command once the GPOADmin host computers have restarted to install the GMSA: Install-ADServiceAccount -Identity <service_account_name>.

c	Run the following PowerShell command to verify that the GMSA was successfully installed. The command will return True if the GMSA was successfully installed: Test-ADServiceAccount -Identity <service_account_name>.

5	Follow the Minimum permissions required for the service accounts and replace the service account with the group the GMSA member of create in step 4.


	NOTE: If configuring for SQL, enter the actual GMSA instead of the group when specifying a windows login.

Once the service is using a GMSA account, the password is retrieved from the LSA. This will disable the ability to stop the service or change the service account.

You can run the following command to switch back to a normal account:

sc <server> managedaccount [service name] [type]. For example, sc managedaccount "QGPMService" false.

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Request a KB Article

Leave a Comment

Recommended Content

Product(s):: GPOADmin
5.22, 5.21, 5.20

Topic(s):: How To

Article History:: Created on: 8/11/2020
Last Update on: 7/16/2026

Search All Articles