Creating gMSA Objects in Active Directory

Introduction

Group Managed Service Accounts (gMSAs) are one of the most useful features available within Active Directory for securely running services, scheduled tasks, and applications.

Unlike traditional service accounts, gMSAs automatically manage password rotation and simplify service principal name (SPN) management. This reduces administrative overhead while significantly improving security.

This guide walks through the process of creating, assigning, installing, and testing a Group Managed Service Account using PowerShell.

What Is a gMSA and Why Is It Important?

A Group Managed Service Account (gMSA) is a special Active Directory account designed for applications and services.

Traditional service accounts often require administrators to manually rotate passwords and update dependent services. gMSAs eliminate this challenge by automatically rotating passwords through Active Directory.

Benefits include:

• Automatic password rotation
• Improved security posture
• Reduced administrative overhead
• Simplified SPN management
• Support for multiple authorized servers

Organizations pursuing modern identity security strategies should strongly consider using gMSAs wherever supported.

Prerequisites

Before creating a gMSA, ensure:

• You have Domain Administrator permissions.
• The Active Directory PowerShell module is installed.
• A KDS Root Key exists.
• An AD security group exists for systems authorized to use the gMSA.

As a best practice, create a dedicated Active Directory group for each gMSA and grant only the minimum permissions required.

Step 1: Verify the KDS Root Key

Open an elevated PowerShell session and run:

# Check for an existing KDS Root Key
Get-KDSRootKey

Example output:

AttributeOfWrongFormat :
KeyValue               : {243, 166, 110, 211...}
EffectiveTime          : 7/16/2024 6:07:17 PM
CreationTime           : 7/16/2024 8:07:17 AM
IsFormatValid          : True
DomainController       : CN=DBTLAB02-DC01,OU=Domain Controllers
KeyId                  : bb8ca585-8dd4-7ddb-01fd-896a0450f21e
VersionNumber          : 1

If no results are returned, create a new KDS Root Key.

# Create KDS Root Key
Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(10))

The ten-hour delay allows sufficient time for Active Directory replication throughout the environment before the key becomes active.

Step 2: Create the Group Managed Service Account

Once the KDS Root Key is active, create the gMSA using:

New-ADServiceAccount `
    -Name ExampleGMSA `
    -DNSHostName examplegmsa.yourdomain.com `
    -PrincipalsAllowedToRetrieveManagedPassword `
    "CN=GRP_gMSA_Example,CN=Users,DC=example,DC=com"

Parameter Reference

Required User Rights

The gMSA must be granted:

• Log on as a Service
• Log on as a Batch Job

These permissions can be assigned through:

Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment

Step 3: Install and Test the gMSA

From an elevated PowerShell session on the target system:

# Install the gMSA
Install-ADServiceAccount -Identity ExampleGMSA

# Test the gMSA
Test-ADServiceAccount -Identity ExampleGMSA

If the test returns True, the account is functioning correctly and can be assigned to supported services and applications.

Additional Identity Security Resources

If you are modernizing authentication and access controls, review our Identity Security Resource Center for additional guidance covering:

• Passwordless Authentication
• Microsoft Entra ID Security
• Secret Double Octopus
• Multi-Factor Authentication
• Zero Trust Access

Conclusion

Group Managed Service Accounts provide a secure and scalable way to manage service credentials within Active Directory environments. By automating password rotation and simplifying administration, gMSAs help reduce risk while improving operational efficiency.

Whether supporting a small environment or a large enterprise deployment, gMSAs should be considered a core component of a modern identity security strategy.