You use group I must say is to extend the capabilities of standard MSA is to more than one server in
your domain in server farms in areas with network load balance and or MLB clusters or IRS servers.
You often need to wrong system or program services under the same service account second standard messages
can not provide a must say functionality to services that are run on more than one server.
However by using group I must say as you can configure multiple servers to use the same I must say and
still retain the benefits that EMRs provide such as automatic password maintains and simplified as being
in management.
What are the requirements for group EMRs.
Your environment must meet the following requirements.
If you want to support group I must say functionality including that at least one domain controller
must be run on Windows Server 2012 or newer to store manage password information client computers.
Your then group of masses must have Windows 8 or newer and server based computers must have Windows
Server 2012 or newer.
You must create a key k d s root key on one of the domains the domain controllers to create the k s
root key.
You must run the following command from the Active Directory module for Windows power shell on Windows
Server 2016 domain controller.
Add k d s root key effective time through effective immediately.
Please know that effective immediately switch uses the current time to establish this timestamp that
marks the key as well it.
However when using the effective immediately switch the actual effective time is set to 10 hours later
than the current time.
This turn our differences to allow the 8 areas the replication to replicate changes to other domain
controllers in the domain for testing purposes.
You can bypass this functionality by setting the effective time parameter to 10 hours before the current
time by running the following command at KDE s root key effective time get date dot add hours minus
down.
Some words about group I must say functionality group of EMRs enable managed service account functionality
across multiple servers by delegating the management of MSA passport information to Windows Server to
2016 domain controllers.
By doing this the management of passwords is no longer dependent on the relationships between a single
server and a tedious but is controlled entirely by ADF.
The group managed service account object contains a list of principals are the computers or aided is
groups which are allowed to retrieve group MSA password information from ADT as the principals that
can use the managed service account group for authentication for services.
Your carrier group AMA says by using the same command letters that you used for creating the standard
I must say from the active directory module for Windows power cell that is the command.
Let's use for managed service account management greed group MSA by default on Windows Server 2016 domain
controller grid and you might say by using the new HD service account command lab with the principles
allowed to retrieve manage password parameter this parameter accepts one or more comma separated computer
accounts or ADT has groups that are permitted to obtain password information for the group.
I must say that is taught in aid it is on Windows Server 2016 domain controllers for example the following
command let creates a new group Imam essay called sequel form and enables the long sequel one long sequel
to a long sequel three hosts to use the group I must say you could type new HD service account name
log on sequel form principles allowed to retrieve manage password and the names of the servers after
you add a computer to use the principles aloud to retrieve managed password parameter you can assign
the group I must say two services by using the same assignment process as standard Emma says you can
use ADT as security groups to identify.
Group says when you use an 82 years group for the principles allowed to retrieve managed password parameter.
Any computers that are members of the group will be allowed to retrieve the password round utilize group
MSA functionality when you use an 80 days group as the principal allowed to retrieve or manage password
any accounts that are members of the group will also have the same capability.
Next up will see the demonstration of how to configure group Hamas says.