To finish this exercise,
let's take a look at group Managed Service Accounts or gMSAs.
I've got some PowerShell to demonstrate this.
I give you this PowerShell file as I always do with my
source code in the exercise files.
We're here in Visual Studio Code on one of my domain controllers,
and I've installed the PowerShell extensions,
so I have language support, and because it's a domain controller,
I have the Active Directory PowerShell module already installed.
The script file has some references to some helpful Microsoft docs here,
and there is a reminder that some common use cases of the group
Managed Service Accounts are IIS app pools,
Windows services and tasks.
However, if you're using Windows failover clustering,
the cluster's own service account, at least at this time in early 2021,
does not work with gMSAs.
The Key Distribution Service, or KDS, is what's
responsible for maintaining the password.
So we have to run on line 5, Add‑KdsRootKey,
and it does take 10 hours for replication and for that to settle.
So on line 7, I actually ran this as a cheat.
I wouldn't recommend you do that in a production environment.
So what we're going to do in this case is this machine,
rootdc1. Let's say we want to give both this machine,
rootdc1, as well as my other timw.info domain controller rootdc2,
membership to a new gMSA that I'll call web.
So what we can do on line 9 is run New‑ADServiceAccount,
giving it a name of web.
Managed password interval in days is 30.
By the way,
if you're wondering about what the mins and maxes and all of that kind of stuff,
never forget about using good, old Get Help,
where we can just do the name of the command,
and then if you throw in ‑online, and you're connected to the internet,
you can go out to the latest help article by using your default web browser.
Specifically,
what I'll want to do after I zoom in a little bit is go to Parameters,
and we can look up if we want to know about that managed password interval,
the parameters are in alphabetical order.
Though it says here that the managed password interval
in days it's an integer parameter,
and it specifies the number of days of set to 0 then the default is used.
Now, what's the default?
The default is 30 days.
So again, that's just a notion.
If you're not good with PowerShell yet, I'd suggest you get good,
even though there's not an awful lot of complex PowerShell on AZ‑800 or 801.
So after the ManagedPasswordIntervalInDays parameter,
we have the PrincipalsAllowedToRetrieveManagedPassword.
That's really important.
That's going to be the Active Directory group that
contains those servers. Web farm,
you know what? I haven't yet created web farm, so let's go
back to Users and Computers. I will just temporarily put it
in the Computers container.
I'm going to create a new global security group called Web Farm, and then
we're going to populate that group. We'll click Add,
make sure that our object type includes Computers, and
then I'm going to do a search for root.
We want to bring in rootdc1, and let me do that again.
I think I might have to set the object type again.
No, I don't.
Good deal. Click Root, we'll bring in rootdc2, and so now those computers
belong to Web Farm, and now line 9 should work just fine.
So let's right‑click Run the selection. And then we can
verify that we've created the gMSA by running
Get‑ADServiceAccount, as you can see here.
Also, if we come back to Active Directory,
Users and Computers,
you can see in the Managed Service Account container, we have our web
identity there. Next step is we're going to install or register the
service account on our computers, and I have some invoke commands, and I
was getting started on how I could iteratively loop through in a
collection of computers to do that.
So you see what we've done so far? We've got a global group that contains
the servers that will share the Managed Service Account.
We then created the service account, we retrieved its metadata.
The last step is on each of our servers to run
Install‑ADServiceAccount to make sure that it's properly registered.
Let me right‑click to install this service account on the local server.
We can test to verify that the Managed Service Account has
been installed properly by running Test‑ADServiceAccount,
and if it comes back as true, we're good to go.
So finally,
to demonstrate how we would implement this service
account, let me open the Services Control Manager here and
let me pick on a Windows service,
just as a representative example. Let me grab this device picker,
and the idea here is that we would specify the name of the
service account domain\serviceAccount,
but we want to be really careful not to supply any passwords
here, because this is a group Managed Service Account that's being managed by Active Directory itself.