Group Managed Service Account

---

Hello,

I encountered a question from 70-410 practice exam as follows:

Your network contain an Active Directory domain named contoso.com. The domain contains a server named Server1. The Server1 runs a windows server 2012R2. You create a group Managed Service Account named gservice1. You need to configure a service named Service1 to run as gservice1 account

How should you configure Service1?

I followed exam objectives presented through videos from 70-410 and could not have figured out what exactly the question meant. All I know is that the group Managed Service Account is a default container in AD Users and Computers. How does this account associate with a given service? Is it analogous to a user account placed in the Users container?

Would you please explain the above question along with technical concepts involved within the question context with diagram or simple example that I can follow?

Thank you

Hey Truong,

Group managed service accounts are called out on the 70-411 objectives. That is where we cover creating and using them.

Because there is overlap on the exams, is helps to have gone through all of the server episodes at least once before preparing for any of the server exams.

Once the group managed service account is created and assigned to the server, which has already been done in the question, you need to tell the service to run as the newly created service account. You accomplish this through the services console. You access the properties of the particular service, in this case, Service1. Then, on the log on tab of the service properties, select the 'this account' radio button. Click the browse button and find the group managed service account (gservice1) you want the service to run as. You will leave the password blank, because the system will manage the password for the group managed service account. Then click OK.

Now service1 will run under the context of gservice1, and Windows will manage the password for gservice1

Thanks Mike for the clear, sequential steps to configure the service. Would you please point me to the right video in 70-411 that I can watch and thoroughly understand the concept before selecting the right choice for the above question. (given I knew the correct answer through answer key)

Why does the service, e.g. DNS service, need to run as a group Managed Service Account? What happens if it does not? I googled and had a slight idea that running a service as a group Managed Service Account would eliminate the administrative task of password management. What password management does it refer to? I do not understand, given that your response briefly mentioned about password?

A. From the Services console, configure the recovery setting.

B. From the command prompt, run sc.exe and specify the config parameter.

C. From the Window Poweshell, run the Set-Service and specify the -PassThrough parameter.

D. From the command prompt, run sc.exe and specify the sdset parameter.

It appears that I need to clearly grasp the concept in order to rule out wrong choices (by understanding what exactly the statement of each choice mean) before arriving with the final correct answer.

old post, but I saw it so I figured I'd answer that last question:

The main reason is simply this, gMSAs use the same classes as the user and the computer, which is derived from TOP in the schema. The way of handling it 'old hat' and not running it as a super privileged account such as LocalSystem was to assign it a user account. This meant that every time the password expired you would have to update the password on the account(s) that you'd set up for these services, which could create downtime if you allowed them to expire. Since the world has been moving towards 'always-on', i.e. "HA Environments" having a service go down can be catastrophic. A lot of the best promise 'five nines' or 99.999% uptime, what this equates to in something humans recognize is something like 5 and a half minutes of downtime per YEAR. So in turn this leads to administrators simply setting the 'password never expires' flag on a service account. While it does work, its bad news mainly because if anyone ever steals or cracks that password they may have uninhibited control of your service. You may or may not have heard a few years ago about Target getting hacked. This was done through a point of sale service account because it had a weak password but was set to never expire, so it never was improved.

So long story short, to avoid terrible security practices Microsoft's answer is to use the gMSA to have a user that is more similar to a computer account and updates its own random password with the domain every X number of days (think 30 by default)

Does that clarify the reason for it?

Marking this post as solved with no additional activity.