Managed Service Accounts: Configure a Service Using MSA

Posted on June 14, 2012 by Jeff Hicks in Active Directory with 0 Comments

In part one of this three-part series, we looked at how to set up a managed service account (MSA). These accounts, which I’ll refer to as an msa, are stored in Active Directory and can be implemented on Windows 7 or Windows Server 2008 R2. In Part 1 we saw how to create, find, and modify them using Windows PowerShell. There is no graphical interface really; you have to use Windows PowerShell or find a third party tool. I’m going to manage from my Windows 7 client with RSAT and the Microsoft ActiveDirectory module.

Today we’re going to learn to add the MSA to a member server and configured a service. And in the third and final part, we’ll look at steps involved in changing or rolling back the MSA.

The next step is to connect the msa to the computer account in Active Directory. An msa can only be associated with one computer account at a time, but a computer can have multiple msa’s. In Part 1, I created an account to be used on CHI-FP01 with a new service I will be installing.


Notice that HostComputers is empty. We’re going to add this msa to the CHI-FP01 computer account using the Add-ADComputerServiceAccount cmdlet. I like that this cmdlet supports –Whatif and –Confirm.

That looks right so I can re-run the command, dropping –Whatif. By default, nothing is written to the pipeline unless you use –Passthru.

Checking the msa again, we now see a value for HostComputers.

Despite the property name, even though you can theoretically add the msa to other computer accounts, it can only be used by one at a time, at least with my testing. Because this is an update to Active Directory, depending on the location of the member server or desktop in question, you may need to wait for the change to replicate to all your domain controllers.

When you are ready, the last step is to “install” the msa on the host computer. We will use the Install-ADServiceAccount cmdlet. Now for the unfortunate part: this command must be run ON the member server or domain. That’s right. This means you need to at least temporarily install and configure RSAT, including the AD PowerShell module. You will also need at least version 3.5.1 of the .NET Framework. Finally, you must run the command in an elevated PowerShell session with an administrative account. The next disappointment is that you can’t use PowerShell remoting to install the service account. At least I’ve never been able to get it to work. I can get around the 2nd hop problem but when it comes down to finally installing, PowerShell complains with an unknown error. So, you’ll have to open an interactive console session and run:

Once installed, you can use the Services management console to specify the new logon account. You might need to browse or search your domain for the account. You most likely will also have to set an initial password.

Or, you can use WMI and make the change, locally or remotely.


A value of 0 means success. I then need to restart the service for the change to take effect. Normally, I prefer using Invoke-WMIMethod for this type of task, but because you have to specify all the Null values before you get to the service account name, this cmdlet doesn’t play well with others. But, I now have a managed service account in place.


We’ll wrap up next time by looking at how uninstall and remove managed service accounts.


Tagged with ,