Export keys fails using gMSA

Question

Hello, I am about to install MIM Synchronization Service on a Windows 2012R2 system. I used SP2 if MIM2016 to install it and updated it to the lates hotfix release 4.6.359.0. I used the available descriptions to install the sync service using a gMSA account.
The service runs OK and I can access everything as expected with the service manager.
But one thing is just not working out - exporting the encryption keys via miiskmu.exe.
I started it via 'run as admin' and started miiskmu.exe via administrative command line: miiskmu.exe /e c:\configBU\exp3.bin /u:"mydomain\SVC-MIMSync$" The output is as follows:

Installing assembly 'C:\Program Files\Microsoft Forefront Identity Manager\2010\ Synchronization Service\Bin\Microsoft.IdentityManagement.KeyProtectService.exe'. Affected parameters are: assemblypath = C:\Program Files\Microsoft Forefront Identity Manager\2010\Syn chronization Service\Bin\Microsoft.IdentityManagement.KeyProtectService.exe logfile = C:\Program Files\Microsoft Forefront Identity Manager\2010\Synchron ization Service\Bin\Microsoft.IdentityManagement.KeyProtectService.InstallLog Installing service MIMKeyProtectService...  
Creating EventLog source MIMKeyProtectService in log Application...  

The contents of the installLog ends at the same line 'Creating EventLog source MIMKeyProtectService in log Application...'.
The same works without a problem when using a standard account instead of a gMSA account.
For any reason the spun up application is not able to create an event log source when running with a gMSA account.
Can someone give me a hint what I am missing? Thanks a lot!

Answer 1

When specifying a gMSA for the MIM Sync service account, the miiskmu.exe utility installs a Windows service (KeyProtectService) to get the gMSA password. That service has a dependency on .NET 3.5, which is NOT listed as a requirement for the MIM Sync server.

PS C:\> $exePath = "E:\Program Files\Microsoft Forefront Identity Manager\2010\Synchronization Service\Bin\Microsoft.IdentityManagement.KeyProtectService.exe"
[Reflection.Assembly]::ReflectionOnlyLoadFrom($exePath).GetReferencedAssemblies()

Version        Name                                                                              
-------        ----                                                                              
2.0.0.0        mscorlib                                                                          
2.0.0.0        System.ServiceProcess                                                             
2.0.0.0        System.Configuration.Install                                                      
2.0.0.0        System                                                                            
4.6.0.0        Microsoft.IdentityManagement.Logging                                              
3.5.0.0        System.Core                                                                       
2.0.0.0        System.Security                                                                   

Answer 2

Problem has been solved after installing everything on a new and clean installed machine.

Answer 3

Another question comes into my mind. What is the impact of this tool and the encryption keys anyways. I have changed the MIM Sync Service Account now for serval times from local to domain and gMSA users, but I was still able to start the service and my management agents without any problems so far. It is only miiskmu which is not working when using a domain account as a service account. Miiskmu is working when using a local account as service account.
To be more specific about the environment I am using. It is just the sync service I am using, no Sharepoint, MIM Service or anything else is running.

Answer 4

Yes - the screenshot is from using the GUI. And yes I used 'run as admin'.

Answer 5

Hi,

Do you get the same error if you run the application GUI?

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/backing-up-the-synchronization-service-encryption-key/ba-p/973886

Br,
Leo