Mastering Active Directory

Group Managed Service Accounts

In the previous section, we talked about Managed Service Accounts. One Managed Service Account can be used with one computer only. But there are operation requirements which require the same service account to be shared in multiple hosts. Microsoft's network load balancer, the IIS server farm, is a good example of this. All the hosts in these server groups are required to use the same service principal for authentications. Group Managed Service Accounts (gMSA) provides the same functionalities as Managed Service Accounts, but it extends its capabilities to host group levels. This was first introduced with Windows Server 2012.

The gMSA has got the following capabilities:

• No password management
• Supports sharing ...