Planning for authentication with gMSA (4226237)

立即与支持人员聊天

获得即时帮助
完成注册

登录

请求定价

联系销售人员

反馈已提交

本文是否解决了您的问题？

选择评级

标题

Planning for authentication with gMSA
说明

How to plan for using GMSA with Foglight
解决办法
If you intend to use gMSA (Group Managed Service Accounts) for authentication, the gMSA infrastructure should be configured prior to Foglight installation. Refer to the Microsoft document Group Managed Service Accounts Overview for information

When authenticating to the external Foglight database using gMSA (Group Managed Service Accounts), take note of the following requirements.
- When using gMSA for authentication, you must install Foglight using SQL Server Authentication. Once Foglight is installed, you can configure the appropriate gMSA account for repository authentication
- The gMSA account must have the following accounts mapped on the external SQL repository:
  - foglight
  - master
  - model
  - msdb
  - tempdb
- When authenticating with gMSA, the Foglight Management Server (FMS) and Foglight Agent Manager (FglAM) must be installed as a service. Once installed, the Log on as account must be updated to the gMSA account.
- The gMSA account requires the -PrincipalsAllowedRetrieveManagedPassword permission. This permission is also required on each service host.
  For an account gMSA01 and host ServiceHost, you can grant this permission with the command:
  
  Set-ADServiceAccount gMSA01 -PrincipalsAllowedToRetrieveManagedPassword gMSA01$,ServiceHost01$,ServiceHost02$
  
  Note: The Set-ADServiceAccount command will overwrite the current value of PrincipalsAllowedToRetrieveManagedPassword for the user; to verify the current value run Get-ADServiceAccount -Identity gMSA01 -Properties PrincipalsAllowedToRetrieveManagedPassword
- Active Directory module for Windows PowerShell on the host where you want to use the gMSA account is not enabled by default. Please run the following PowerShell command on the host:
  
  PS C:\> Add-WindowsFeature RSAT-AD-PowerShell
- The gMSA account must have read and write permissions on the FMS and FglAM installation directories.
- On the machine of the FglAM/FMS, run the following command:
  
  Install-ADServiceAccount -Identity gMSA01
- The gMSA account(s) must be configured with appropriate access, as stated below:
  - The FMS gMSA account needs access to:
    - SQL Server used for FMS repository if using Windows authentication
    - PI SQL Server instances
  - The FglAM gMSA account needs access to:
    - any SQL Server instances that it monitors
    - WMI/WinRM access to any hosts that need to be monitored
- GMSA accounts typically end in a $, such as FOGLIGHT\DEMOACCOUNT$, similar to computer objects in AD.
- Knowledgebase article 4370132 details how to use the gMSA in the Command Line Installer (CLI) of database agents
- Knowledgebase article 4309105 details how to install a FMS repository using SQL Server with gMSA
- Knowledgebase article 4226284 details how to use gMSA with the SQL PI repository
- When creating a database agent using gMSA, choose the radio button to "Use the Active Directory Account running your agent manager" similar to the following:
- When adding the Operating System Monitoring Extension using a gMSA account to a database agent, choose the radio button to "Log in to the host using different login credentials" with the "Local User" pulldown in the Authentication field. The username should be automatically populated as in the following:

反馈已提交

本文是否解决了您的问题？

选择评级

Request a KB Article

建议的内容

产品：: Foglight
8.1.0, 8.0.0, 7.3.0, 7.1.0, 6.3.0, 6.1.0; Foglight Evolve
7.3.0, 7.1.0, 6.3.0, 6.1.0, 9.3, 9.2, 9.1, 9.0; Foglight for Databases
8.1.0, 8.0.0, 7.3.0, 7.1.0, 6.3.0, 6.1.0, 6.0.0

主题：: Troubleshooting, Installation, Configuration

文章历史记录：: 创建时间： 5/2/2022
上次更新时间： 12/8/2025

搜索所有文章

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Planning for authentication with gMSA (4226237)

标题

说明

解决办法

Leave a Comment