GMSA

Group Managed Service Account

Create a group managed account doing the following:

1. Verify or Create the KDS Root Key

The KDS root key is required for gMSAs to function. To check or create it:

• Open PowerShell as a Domain Admin on a domain controller or a machine with AD PowerShell modules.
• Run the following command to check if the KDS root key exists: powershell Get-KdsRootKey
• If no key is returned, create one: powershell Add-KdsRootKey -EffectiveImmediately Note: If you want the key to be effective immediately for testing, use -EffectiveImmediately. In production, it’s recommended to allow replication (up to 10 hours) by omitting this parameter or setting a future effective time.

2. Create the gMSA

Create a gMSA for the SQL Server service. This account will be used by both hosts.

• Open PowerShell with AD module access.
• Run the following command to create the gMSA: powershell

New-ADServiceAccount -Name "gMSA-SQLService" `
-DNSHostName "<dnshostname>" `
-PrincipalsAllowedToRetrieveManagedPassword "<hostname of server>", "<hostname of server>" `
-ServicePrincipalNames "MSSQLSvc/<hostname of server>.<domain name>", "<hostname of server>.<domain name>" `
-Description "gMSA for SQL Server" `
-Path "OU=ServiceAccounts,DC=domain,DC=domain"

3. Grant Permissions to Hosts

Ensure the computer accounts for mh-cts-rdsql-01 and mh-cts-rdsql-02 have permissions to use the gMSA. The -PrincipalsAllowedToRetrieveManagedPassword parameter in the previous step already configures this, but you can verify or modify it:

• To check: powershell

  Get-ADServiceAccount -Identity "gMSA-SQLService" -Properties PrincipalsAllowedToRetrieveManagedPassword
  

• To add another host (if needed): powershell Set-ADServiceAccount -Identity "gMSA-SQLService" -PrincipalsAllowedToRetrieveManagedPassword @{Add="serverhostname"}

4. Install the gMSA on the SQL Server Hosts

On each SQL Server host (mh-cts-rdsql-01 and mh-cts-rdsql-02), install the gMSA so the system can retrieve its credentials.

• Log in to the host as a local administrator.
• Open PowerShell as Administrator.
• Install the Active Directory PowerShell module (if not already installed): powershell Install-WindowsFeature RSAT-AD-PowerShell
• Test and install the gMSA: powershell Install-ADServiceAccount -Identity "gMSA-SQLService" Test-ADServiceAccount -Identity "gMSA-SQLService"
• If Test-ADServiceAccount returns True, the gMSA is successfully installed. If it fails, check:
  • The host is domain-joined.
  • The computer account is listed in -PrincipalsAllowedToRetrieveManagedPassword.
  • The KDS root key is replicated and effective.

5. Configure SQL Server to Use the gMSA

Configure the SQL Server service on both hosts to use the gMSA.

• Open SQL Server Configuration Manager on each host.
• Navigate to SQL Server Services.
• Right-click the SQL Server service (e.g., SQL Server (MSSQLSERVER)) and select Properties.
• In the Log On tab:
  • Select This account.
  • Enter the gMSA account in the format: mricts\gMSA-SQLService$.
  • Leave the Password field blank (gMSAs manage passwords automatically).
• Click Apply and OK.
• Restart the SQL Server service to apply the changes: powershell Restart-Service -Name MSSQLSERVER Note: If SQL Server is running under a different instance name, adjust the service name (e.g., MSSQL$INSTANCENAME).
• Repeat this process on all servers needing to use the service