Managed Services Account

Collections

Features

MSA accounts are a great option if you’re looking for a secure way to run process or scripts under a service account. In this article we’ll walk through the steps required to create an MSA account.

Note, this article will only discuss MSA accounts and not its cousin the gMSA account (Global Managed Service Account). The primary difference between the two account types is how they apply against a set of servers. MSA accounts can only be applied against one server, while gMSA accounts can be used on multiple servers.

Domain Controller Configuration

Starting on the domain controller, open a PowerShell window and run the followings commands. This will create and assign the MSA account to a specific server.

Create MSA Account

Run the following PowerShell command to create a new MSA account. If a mistake is made, you can safely delete the new account use the Remove-ADServiceAccount cmdlet.

New-ADServiceAccount -Name host01-msa –RestrictToSingleComputer

The newly created MSA account can be viewed in Active Directory Users & Computers under the Managed Service Accounts OU.

ℹ️

By default, this OU is hidden from view. To expose it select View » Advanced Features.

Assign Host

Next, we’ll specify which Windows server the MSA account can be used on.

$Identity = Get-ADComputer -Identity host01
Add-ADComputerServiceAccount -Identity $Identity -ServiceAccount host01-msa

Recall that Managed Service Accounts only allow one server per MSA account. If you’d like to use one MSA account for multiple servers, please see its cousin the gMSA account.

Host Configuration

It’s now time to head onto the server and install the MSA account.

Install RSAT Tools

Start by ensuring the Remote Server Administration Tools (RSAT) are installed. This is a pre-requisite for using an MSA Account.

Add-WindowsFeature RSAT-AD-PowerShell

Install MSA Account

Install the MSA Account onto the server (host01 is our examples) so its available for use.

Install-ADServiceAccount -Identity host01-msa

Verify Account

Lastly, verify its functionality. If the account is ready for use, the command should return true.

Test-ADServiceAccount host01-msa

Usage

Within the MSAScheduledTask.ps1 script is an example of using an MSA account. Highlighted below is a MSA account, in this case TWOBYTE\host01-msa$, being used to run a script on a set schedule.

MSAScheduledTask.ps1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


# Location of Script to run.
$ScriptPath = "\\ad.twobyte.blog\scripts\myscript.ps1"

# Account to run script under. In this case an MSA account.
$LogonAccount = 'TWOBYTE\host01-msa$'

# When the Scheduled Task should run.
$ScheduledDayofWeek = "Tuesday"
$ScheduledTime = "9am"
...

Troubleshooting

If needed, you can use PSExec to run a PowerShell window under the MSA account. Below is the requisite command to start a PowerShell session as the MSA account.

.\PsExec.exe -i -u in\host01-msa$ -p ~ powershell.exe

Recycle Bin Fine-Grained Password Policy