Based on: https://zcusa.951200.xyz/en-us/azure/active-directory/fundamentals/service-accounts-group-managed I'm trying to implement the gMSA for the following scenario: Task Scheduler account Service account (Failover Cluster, SQL Server, ADFS, Azure AD Connect, DHCP) Would that be working for the above scenario or will cause some issues? I would appreciate any assistance you can provide.

Hi @EnterpriseArchitect , Task Scheduler account => GMSA is supported Failover Cluster => is not supported : Group Managed Service Accounts Overview SQL Server => GMSA is supported ADFS => GMSA is supported : Creating an AD FS Farm without domain admin privileges Azure AD Connect => you can use GMSA , I alreday use it in my infra DHCP => GMSA is not supported Please don't forget to mark helpful answer as accepted

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query This should work. But what I can suggest is try to adjust your permission or the permission for the gMSA to make sure that the service account required access has it. In addition, it depends on your service accounts. You maybe need configuring Kerberos delegation so that the required authentication for the services will be provided for the gMSA. If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

Hi, while running service with GMSA, you need to keep the password blank. However, for task scheduler blank password does not work. You need to create, configure task using PowerShell if you want to run it using GMSA. Also, you can create a task with normal account and define parameters. Later, you can run the command below to replace the normal user account with GMSA schtasks /change /TN \test_gmsa_task /RU contoso\testgmsa$ /RP Note: The command is not documented in any Microsoft documents but it does it's work. However, if it does not work for some reason, you may not get support from Microsoft to troubleshoot why it does not work.

Hi @limitless technology & @thameur, How do you type in the password for gMSA when it is used as a Service account and Task Scheduler?

Using gMSA for Task scheduler and Service account scenario?

EnterpriseArchitect 5,406

Based on: https://zcusa.951200.xyz/en-us/azure/active-directory/fundamentals/service-accounts-group-managed

I'm trying to implement the gMSA for the following scenario:

Task Scheduler account
Service account (Failover Cluster, SQL Server, ADFS, Azure AD Connect, DHCP)

Would that be working for the above scenario or will cause some issues?

I would appreciate any assistance you can provide.

Accepted answer

Thameur-BOURBITA 33,011 Reputation points

2023-03-03T09:43:38.8+00:00
Hi @EnterpriseArchitect ,

Task Scheduler account => GMSA is supported

Failover Cluster => is not supported : Group Managed Service Accounts Overview

SQL Server => GMSA is supported

ADFS => GMSA is supported : Creating an AD FS Farm without domain admin privileges

Azure AD Connect => you can use GMSA , I alreday use it in my infra

DHCP => GMSA is not supported

Please don't forget to mark helpful answer as accepted
Please sign in to rate this answer.

1 person found this answer helpful.
EnterpriseArchitect 5,406 Reputation points

2023-03-03T11:36:43.8833333+00:00

Thank you @Thameur-BOURBITA , Is there any URL for the gMSA support so I know which one can be supported and which cannot?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

5 additional answers

Limitless Technology 44,411 Reputation points

2023-03-02T14:38:43.5866667+00:00

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

This should work. But what I can suggest is try to adjust your permission or the permission for the gMSA to make sure that the service account required access has it. In addition, it depends on your service accounts. You maybe need configuring Kerberos delegation so that the required authentication for the services will be provided for the gMSA.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.
Please sign in to rate this answer.

1 person found this answer helpful.
EnterpriseArchitect 5,406 Reputation points

2023-03-02T14:52:55.91+00:00

Which one works?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Mukesh Agarwal 15 Reputation points

2024-05-30T13:00:06.68+00:00

Hi, while running service with GMSA, you need to keep the password blank. However, for task scheduler blank password does not work.

You need to create, configure task using PowerShell if you want to run it using GMSA. Also, you can create a task with normal account and define parameters. Later, you can run the command below to replace the normal user account with GMSA

schtasks /change /TN \test_gmsa_task /RU contoso\testgmsa$ /RP

Note: The command is not documented in any Microsoft documents but it does it's work. However, if it does not work for some reason, you may not get support from Microsoft to troubleshoot why it does not work.
Please sign in to rate this answer.

1 person found this answer helpful.
ErwinderKinderen-2410 0 Reputation points

2024-09-27T13:36:28.0233333+00:00

Your answer works. ChatGPT couldn't figure it out. Thanks.

Emiliano Giovannetti 0 Reputation points

2024-10-24T10:33:56.8833333+00:00

@Mukesh Agarwal , following your suggestion I'm getting this error:
PS C:\WINDOWS\system32> schtasks /change /TN \"Test InQuote - Stage distances CSVs" /RU domain\it015-p-dbaa00$ /RP

WARNING: When the run-as password is empty, the scheduled task may not run because of the security policy.

ERROR: The user name or password is incorrect.
I've also tried to set the principal this way:
PS C:\WINDOWS\system32> $principal = New-ScheduledTaskPrincipal -UserId 'EMEA\IT015-P-DBAA00$' -LogonType Password -RunLevel Highest

PS C:\WINDOWS\system32> Register-ScheduledTask -Action $action -Trigger $trigger -Principal $principal -TaskName "Test InQuote - Stage distances CSVs"

Register-ScheduledTask : The user name or password is incorrect.

At line:1 char:1

+ Register-ScheduledTask -Action $action -Trigger $trigger -Principal $ ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : AuthenticationError: (PS_ScheduledTask:Root/Microsoft/...S_ScheduledTask) [Register-Sche

duledTask], CimException

+ FullyQualifiedErrorId : HRESULT 0x8007052e,Register-ScheduledTask

Any clue?
Thanks
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more
EnterpriseArchitect 5,406 Reputation points

2023-03-27T00:37:14.73+00:00

Hi @limitless technology & @thameur,
How do you type in the password for gMSA when it is used as a Service account and Task Scheduler?
Please sign in to rate this answer.
Thameur-BOURBITA 33,011 Reputation points

2023-03-27T05:33:04.27+00:00

Hi

You don’t need to type password,

you have just specify the account name .
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Using gMSA for Task scheduler and Service account scenario?

5 additional answers

Your answer