Group Managed Service Account

-

i have 2 domains have full trust. can make managed service account in each domain , have them both use same gmsa group adprincipal?

hello,

think of group managed service accounts usable version of managed service account.  gmsas, windows server 2012 has addressed of limitations of msas.  specifically a single gmsa can used on multiple hosts.

if create security group , add computer objects of hosts allowed use gmsa. can have computer objects other trusted domain usual.

regards,

yan li

please remember mark replies answers if , unmark them if provide no help. if have feedback technet subscriber support, contact tnmff@microsoft.com.



Windows Server  >  Directory Services



Comments

Post a Comment

Popular posts from this blog

Windows server 2012 r2 inplace upgrade failed

-
trying upgrade windows server 2012 2012r2 on physical box/nas (hosting vm's). this failed due "unknown error"? there several error logs, first few lines of 1 attached: setuperr.og (from c:\$windows.~bt\windows) 2013-10-06 14:22:55, error      [0x0803b6] mig    can't retrieve group information user nt service\mssql$microsoft##wid. netusergetlocalgroups failed 0x000008ad 2013-10-06 14:22:55, error      [0x0803b6] mig    can't retrieve group information user iis apppool\classic .net apppool. netusergetlocalgroups failed 0x000008ad 2013-10-06 14:26:23, error      [0x0808fe] mig    plugin {0b23c863-4410-4153-8733-a60c9b1990fb}: loadlibraryex error (c:\$windows.~bt\sources\replacementmanifests\microsoft-windows-textservicesframework-migration\imjpmig.dll) gle=126 2013-10-06 14:26:23, error      [0x0808fe] mig  ...
Read more

AD controllers wont synchronize data

-
i have 3 domain controllers in 2008 ad environment. days ago found 1 corrupt , caused problems. server first server in domain , holds certificate service + dfs registrations. servers running on vmware. decided restore de server old backup (12 months old). restored server fine off course outdated , needs synchronized 2 existing. first cleaned little in dns following procedure: renamed system32\config\netlogon.dns , netlogon.dnb files ipconfig /registerdns net stop netlogon net start netlogon that eliminated first error had replication. “the target principal name is incorrect” next remove lingerine objects using: repadmin /removelingeringobjects restored_server1.domain.com 83feb989-46eb-4c0b-9c6f-bae9ec24542c "dc=domain, dc=com" then tried following: repadmin /replicate restored_server1.domain.com working_dc.domain.com dc=domain,dc=com /force repadmin /replicate restored_server1.domain.com working_dc.domain.com cn=configuration, dc=domain...
Read more

Failed to delete the test record dcdiag-test-record in zone test.com

-
ps c:\users\administrator.test> dcdiag /test:dns directory server diagnosis performing initial setup:    trying find home server...    home server = dc02    * identified ad forest.    done gathering initial info. doing initial required tests    testing server: default-first-site-name\dc02       starting test: connectivity          ......................... dc02 passed test connectivity doing primary tests    testing server: default-first-site-name\dc02       starting test: dns          dns tests running , not hung. please wait few minutes...          ......................... dc02 passed test dns    running partition tests on : forestdnszones    running partition tests on : domaindnszones    running partition tests on : schema ...
Read more