What are the steps and procedure to use gMSA as the Windows Server Service Account?

Question

After creating the gMSA using the below PowerShell, how can I successfully replace the services in all of my Windows Server Application servers?

New-ADServiceAccount -Name New-gMSA -DNSHostName Mydomain.com -PrincipalsAllowedToRetrieveManagedPassword "AppServer-AD-SecGrpName"

Thank you for your help and suggestions.

Answer 1

1. Ensure the gMSA is Active on All Target Servers:
   • On each application server, install the AD PowerShell module and run:

          
          Test-ADServiceAccount -Identity "New-gMSA"
     

   • If the result is True, the server can retrieve and use the gMSA.
2. Grant Permissions to Use the gMSA:
   • Ensure the service has the correct permissions. On the server, run:

          
          Add-ADComputerServiceAccount -Identity <AppServerName> -ServiceAccount "New-gMSA"
     

3. Stop the Service to Update Credentials:
   • On each server, stop the service that needs to use the gMSA:

          
          Stop-Service -Name "<ServiceName>"
     

4. Update the Service to Use the gMSA:
   • Use the following command to update the service credentials:

          
          $serviceName = "<ServiceName>"
     

$gMSA = "New-gMSA$" # Add $ to indicate gMSA Set-Service -Name $serviceName -StartupType Automatic sc.exe config $serviceName obj= $gMSA password= "" ```

1. Grant Logon as a Service Right:
   • Use Group Policy or manually grant the gMSA "Log on as a Service" permission. You can set this locally:

          
          ntrights -u "New-gMSA" +r SeServiceLogonRight
     

2. Start the Service with gMSA:
   • Start the service with the new credentials:

          
          Start-Service -Name "<ServiceName>"
     

3. Verify the Service is Running Properly:
   • Check that the service is running without issues:

          
          Get-Service -Name "<ServiceName>"
     

---

Automating for Multiple Servers and Services

You can automate the steps using PowerShell remoting across multiple servers. Here’s a sample script for multiple servers:

$servers = @("AppServer1", "AppServer2", "AppServer3")
$serviceName = "<ServiceName>"

foreach ($server in $servers) {
    Invoke-Command -ComputerName $server -ScriptBlock {
        Stop-Service -Name $using:serviceName
        sc.exe config $using:serviceName obj= "New-gMSA$" password= ""
        Start-Service -Name $using:serviceName
    }
}

---

Important Considerations

• Restart Servers: Some services may require a server reboot to correctly apply the gMSA.
• Firewall & Policy Configs: Ensure no group policies or firewalls block the new service account from accessing necessary resources.
• Testing: Always test in a staging environment before rolling out changes in production.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin