Converse agora com nosso suporte

Obtenha ajuda em tempo real
Concluir registro

Entrar

Solicitar preços

Entre em contato com o setor de vendas

How to configure GPOADmin to use a Group Managed Service Account (GMSA) ? (4285897)

Voltar

Feedback enviado

Este artigo resolveu um problema para você?

Selecione a classificação

Título

How to configure GPOADmin to use a Group Managed Service Account (GMSA) ?
Descrição

The following steps can be use to configure a GMSA on GPOADmin

Resolução

To configure GPOADmin to use a Group Managed Service Account

1	Create the Key Distribution Services KDS Root Key. For details, see https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj128430(v=ws.11)?redirectedfrom=MSDN.

2	Create a Global security group and add the computers that will host the GPOADmin service.

3	Create the Group Managed Service Account for GPOADmin using the New-ADServiceAccount PowerShell command. For more details, see https://docs.microsoft.com/en-us/powershell/module/addsadministration/new-adserviceaccount?view=win10-ps.

Set the -PrincipalsAllowedToRetrieveManagedPassword switch to specify the name of the global security group created in step 2.

Set the -ServicePrincipalNames switch for the default domain unique SPN. For example. to ‘GPOADmin/GPOADminService/domainxyz.microsoft.com'.

If you require multiple service accounts, set the value to 'GPOADmin/server.domain.com:port#'. For example, GPOADmin/DC1.domain.com:40200. See Managing client connections for more information.


	NOTE: The GMSA will not update the SPN automatically each time the service starts resulting in warnings in the GPOADmin event log. To prevent the service from updating the SPN, add the following to the registry of the GPOADmin service host if it does not exist: Value name: UpdateSPN Value type: DWORD Value path: HKEY_LOCAL_MACHINE\SOFTWARE\Quest\GPOADmin\ServerConfig Value: 0

4	Create a global security group and add the Group Managed Service Account. This security group will be used to grant permission to the service account.

5	Add the security group as a member to the Group Policy Creator Owners group.

6	For each computer that will host the GPOADmin service and that you added to the security group in step 2, do the following:

a	Restart the computer.

b	Run the following PowerShell command once the GPOADmin host computers have restarted to install the GMSA: Install-ADServiceAccount -Identity <service_account_name>.

c	Run the following PowerShell command to verify that the GMSA was successfully installed. The command will return True if the GMSA was successfully installed: Test-ADServiceAccount -Identity <service_account_name>.

7	Follow the Minimum permissions required for the service accounts and replace the service account with the group the GMSA member of create in step 4.


	NOTE: If configuring for SQL, enter the actual GMSA instead of the group when specifying a windows login.

The GPOADmin installer does not currently allow the selection of GMSAs when selecting the service account. Select an existing user account for the installation process.

Once GPOADmin is installed, you can set the service account as the GMSA created above. To do so:

a	Open the Service Control Manager and locate the GPOADmin Service.

b	Right-click and select Properties.

c	On the Log On tab, select This account, and click the Browse button.

d	Enter the GMSA name and click OK.

e	Clear the password fields and click OK.

Once the service is using a GMSA account, select the password from the LSA. This will disable the ability to stop the service or change the service account.

You can run the following command to switch back to a normal account:

sc <server> managedaccount [service name] [type]. For example, sc managedaccount "QGPMService" false.

Feedback enviado

Este artigo resolveu um problema para você?

Selecione a classificação

Solicitar um artigo da base de conhecimento

Leave a Comment

Conteúdo recomendado

Produto(s):: GPOADmin
5.17, 5.16, 5.15, 5.14

Tópico(s):: How To

Histórico do artigo:: Criado em: 8/11/2020
Última atualização em: 5/7/2023

Search All Articles

© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center