Managed Service Accounts (MSA) are intended to run as a service and not to be used by an end user to logon interactively; however, there are some cases where it is necessary for troubleshooting. From the Start Menu, if you right click on the PowerShell icon, select More and then click on “Run as a different user”, it will pop up a credential box. Enter in the gMSA account name and click OK. You will immediately get an error. This is because Active Directly manages the account for you, so we have no way of knowing what the password is...
Continue reading...March 2022
Setup Resource-Based Kerberos Constrained Delegation for Group Managed Service Accounts
In my previous post, I discussed how to setup Kerberos constrained delegation and a limitation of using that method. This post will discuss how we can used resource-based Kerberos constrained delegation to do the same thing. Resource-based KCD was introduced in Windows Server 2012, and is defined as… Windows Server 2012 and later gives service administrators the ability to configure constrained delegation for their service. This model is known as resource-based KCD. With this approach, the back-end service administrator can allow or deny specific front-end services from using KCD. Kerberos Constrained Delegation Overview | Microsoft Docs Our environment will be...
Continue reading...
