Working with gMSAs
gMSAs are managed domain accounts that you use to help secure services. This recipe shows how to work with gMSAs.
Getting ready
To create gMSAs, the Active Directory domain needs to have at least one domain controller running Windows Server 2012 or a newer version.
gMSAs can only be used to run services on domain-joined hosts running Windows Server 2012 and newer versions, or Windows 8 and newer versions.
For the automatic password and Service Principal Name (SPN) management functionality, the domain needs to run at least Windows Server 2008 R2 DFL.
As gMSAs depend on the Key Distribution Service on domain controllers, prepare the forest by running the following line of PowerShell on a system with the Active Directory module for Windows PowerShell:
Add-KdsRootKey -EffectiveImmediately
How to do it...
- To create a gMSA, use the following line of PowerShell on a system with the Active Directory module for Windows PowerShell installed:
New...
