How to Configure a Group Managed Service Account for an Application
Applies to: Windows Server 2019, 2022 and 2025, subject to vendor support.
A gMSA provides automatically rotated domain credentials for supported services without a reusable administrator-managed password.
Business application deployment must follow vendor licensing and backup requirements. Visit networkmanager.info.
Prerequisites
- Confirm KDS prerequisites.
- Use a supported application.
- Create an authorized host group.
- Delegate minimum resource access.
Procedure
Step 1: Check KDS
Verify root key.
Get-KdsRootKeyStep 2: Create host group
Authorize server computers.
New-ADGroup -Name 'GG-CorpApp-gMSA-Hosts' -GroupScope Global -GroupCategory Security
Add-ADGroupMember 'GG-CorpApp-gMSA-Hosts' -Members 'SRV-APP01$'Step 3: Create account
Set allowed principals.
New-ADServiceAccount -Name 'gmsa-CorpApp' -DNSHostName 'gmsa-CorpApp.corp.example' -PrincipalsAllowedToRetrieveManagedPassword 'GG-CorpApp-gMSA-Hosts'Step 4: Install on host
Prepare account.
Install-ADServiceAccount gmsa-CorpAppStep 5: Test
Verify retrieval.
Test-ADServiceAccount gmsa-CorpAppStep 6: Assign service
Use CORP\gmsa-CorpApp$ with no manually stored password.
Verification
Confirm account and test result.
Get-ADServiceAccount gmsa-CorpApp -Properties PrincipalsAllowedToRetrieveManagedPassword
Test-ADServiceAccount gmsa-CorpAppRollback
Move service to prior identity, then remove authorization and gMSA only after dependencies are gone.
Operational notes
Not every installer supports gMSA.
Official references
Explore Netcloud24 Canada.
