An MSA is an A.D. object class that enables simplified password and SBA management for service accounts.
The MSA was introduced in Windows 7 and Windows Server 2008 are to many network based programs use an
account to run services or provide authentication.
For example a program on a local computer might use the local servers network servers or local system
accounts.
This service accounts may work fine.
However these typically are shared among multiple programs and services which makes it difficult to
manage for a specific program.
Furthermore you cannot manage this local service account at the Domain level.
Alternatively it is common that a program might to use a standard domain account that you configure
specifically for the program.
However the main drawback is that you need to manage password manually which in Cruz's administration
effort and managed service account can provide a program with its own unique account while eliminating
the need for an administrator to administer the account credentials manually.
So how an MSA works MSE are restored to an idea says amongst the years dish managed service accounts
objects.
This class inherits structural aspects from the computer class which it inherits from the User class.
This enables an MSA to fulfill a user like functions such as provide an authentication and security
context for a run and service.
It also enables an MSA to use the same password update mechanism that computer objects in ADT s use
which is a process that requires no user intervention.
MSE provides the following benefits to simplify administration.
The first benefit is automatic password management an MSA maintains its own password including password
changes automatically.
Another benefit is simplified SBN management as Pain management happens automatically if you configure
your domain at the Windows Server 2008 our two domain functional level or higher EMRs are stored in
managed service accounts container you can view this by enabling the advanced feature absorption on
The View manager with an Active Directory user or send computers.
This container is visible by default in the Active Directory administrative center.
Now what are our requirements for as an MSA is to use an MSA the server that runs the service or program
must be run on Windows Server 2008 are 2 or newer operating system you also must ensure that Microsoft
Dot Net framework three point five and the Active Directory module for Windows power share are both
installed on the server.
Please know that you can not share a standard MSA between multiple computers or that you use in several
class stores where the service is replicated between nodes.
Additionally you cannot use MSA store for unattended scheduled tasks to simplify and provide full automatic
password and as pain management it is strongly recommended that the Active Directory Domain be out Windows
Server 2008 are two functional level or higher.
However if you have a domain controller that is run on Windows Server 2008 you can update the Active
Directory schema to a Windows Server 2008 are two to support this feature.
The only disadvantage is that the domain administrator must configure wristband data manually for the
EMRs.
Some words about to use an emphasis on Windows Server 2016 domain controllers in Windows Server 2016.
You create MSE as the new group managed service account object type by default.
However on a Windows Server 2016 domain controller you accommodate this by grade and a key distribution
services or TADS root key for the domain to create the root key.
You must run the following command led from the Active Directory module for Windows power shell like
amounts.
Looks as follows.
At key the root key effective time get data that add hours minus 10.
Next up we'll discuss.
Group I must say some more detail including providing further explanation for how you can create a key
the absolute key and the add key ideas root key command lap.
I'll see you there.