RebelAdmin.com - The Tech Blog You Need
RebelAdmin.com - The Tech Blog You Need
  • Active Directory
  • Azure Active Directory
  • Azure
  • Windows Server
  • Contact us
Browsing Tag
msa
Active Directory Windows 2012 Windows Server 2016

Active Directory Managed Service Accounts (PowerShell Guide)

January 4, 2018 No Comments

Services Accounts are recommended to use when install application or services in infrastructure. It is dedicated account with specific privileges which use to run services, batch jobs, management tasks. In most of the infrastructures, service accounts are typical user accounts with “Password never expire” option. Since these service accounts are not been use regularly, Administrators have to keep track of these accounts and their credentials. I have seen in many occasions where engineers face in to issues due to outdated or misplace service account credential details. Pain of it is, if you reset the password of service accounts, you will need to update services, databases, application settings to get application or services up and running again. Apart from it Engineers also have to manage service principle names (SPN) which helps to identify service instance uniquely. 

After considering all these challenges Microsoft has introduced Managed Service Accounts with windows server 2008 R2. These accounts got following features and limitations,

• No more password management. It uses a complex, random, 240-character password and change that automatically when it reaches the domain or computer password expire date.

• It cannot be lock out or use for interactive login. 

• One managed service account only can use in one computer. it cannot be share between multiple computers

• Simplified SPN Management – System will automatically change the SPN value if sAMaccount details of the computer change or DNS name property change. 

In order to create Managed service account, we can use following command, I am running this from the domain controller.

New-ADServiceAccount -Name "MyAcc1" -RestrictToSingleComputer

In above command I am creating service account called MyAcc1 and I am restricting it to one computer. 

Next step is associate the service account with the Host REBEL-SRV01 where I am going to use this service account. 

Add-ADComputerServiceAccount -Identity REBEL-SRV01 -ServiceAccount "MyAcc1"

Next step is to install service account in the REBEL-SRV01 server. We need active directory PowerShell module for this. We can install it using RSAT tools. Once its ready run the command,

Install-ADServiceAccount -Identity "MyAcc1"

Once it’s done, we can test it using,

Test-ADServiceAccount "MyAcc1"

It is return the value True which means the test is successful. 

msa1
 
From active directory server, we can verify the service account by running
 
Get-ADServiceAccount "MyAcc1"
 
msa2
 
Tip – When configure the Manager service account in service make sure to leave the password as empty. You do not need to define any password there as system auto generate the password. 
 
This marks the end of this blog post. Hope this was useful. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.
Continue reading
Reading time: 2 min
Written by: Dishan M. Francis

Search

Generic selectors
Exact matches only
Search in title
Search in content
Search in posts
Search in pages

Microsoft MVP

MVP for Last 5 Years!

July 19, 2018

I am glad to announce that I have been awarded with MVP award by Microsoft for 5th consecutive time. It is a true honor to be a part of such a great community. I got my first award back in 2014 under Active Directory category. […]

Book Release

Mastering Active Directory, Second Edition Released!

August 10, 2019

Mastering Active Directory, Second Edition Released!

As most of you were aware, I published my book "Mastering Active Directory" back in, 2017. When I released it, I had my doubts! It was my first book even though I was writing to blogs for many years.

Follow Us

Twitter
LinkedIn

© 2018 copyright Dishan Francis // All rights reserved