Add the servers on which the gMSA will run into the security group.Create a security group for the servers on which the gMSA will run.This may help explain why we went with the following steps įor simplicity sake we wanted to be able to use one gMSA for all our SQL Servers. You can follow the information at this location if you need to do that. For AD to generate passwords for gMSAs, a KDS root key needs to be created. Note: this is not meant to be a step by step guide.įirst make sure to look through the documentation mentioned above for the pre-reqs to ensure you meet all of them. These are some of the best admins you could ever work with.Īlright, let’s get into the implementation info.here is what we did to get our SQL Server services running with a gMSA. īefore I continue, I’d like to mention some of my friends who work at Tata Consultancy Services who did most of the work to make all this happen: Rakesh Silam, RamPratap Yadav, Varun Bejugam, and Dhanraj Rajendraodayar. Pretty great right? You can do your own reading and research on gMSA here. Additionally, the SQL services don’t require a restart when the password is updated, which is required when the password changes for a service account. That’s right, you don’t have to create, store, or update the password! So there’s no chance that it’ll get compromised. The remarkable thing about a gMSA is that Active Directory (AD) manages the password for you. So, to improve our security and make our lives easier at the same time, we decided to switch to using a Group Managed Service Account (gMSA). And I’m sure at times passwords were shared in unsecure ways. While I’d like to think that we did a great job of keeping all this secure, the truth is the passwords had to be copied somewhere for people to perform the password rotation. We had to perform password rotations on each server/service regularly – and store those passwords securely somewhere. We used separate accounts but not for each server because the management was painful enough as it was.

For many years, the best practice was to have a service account for each SQL service – and technically for each instance of SQL. One example of that is for running the SQL services, which is the back end for MECM. To have those run well we follow the common best practice of using dedicated service accounts. MEMCM, MECM, SCCM, System Center Configuration Manager, or even SMS but we’ll refer to it as MECM) and Intune. Like most companies, we have various automations and tools we use to do everything it takes to run Microsoft Endpoint Manager Configuration Manager (a.k.a.

Microsoft easy connect