配置托管服务帐号-白红宇

配置托管服务帐号

阅读量：5826 次

发布时间：2019-06-18

本文共 7627 字，大约阅读时间需要 25 分钟。

MSA 是一种 AD DS 对象类别，能够简化服务帐户的密码及 SPN 的管理。MSA 是从 Windows 7和 Windows Server 2008 R2 开始引入。

MSA 是储存在 AD DS 中当成一种 msDS-ManagedServiceAccount 对象。这个类别 ( class ) 从计算机类别继承架构概念，而从用户类别继承而来。这使得 MSA 能够实现类似用户的功能，例如：执行服务时可以提供验证和安全性的内容，同时也让 MSA 可以使用在 AD DS 中计算机对象所使用的密码自动更新机制，这是一个不需要用户互动的机制流程。

MSA 提供下列好处来简化管理：

自动密码管理。MSA 维护它自己的密码，包含自动变更密码机制。

简化 SPN 管理。如果你配置你的域是在 Windows Server 2008 R2 域功能级别或更高级别时，则会

自动进行 SPN 管理。

Let’s try to get the password of the account under which SQL Server is run.

There is:

Domain controller at Windows Server 2012 R2

SQL Server Express 2012

During the SQL Server installation specify the existing domain account (the password length is less than 14 symbols) to run it.

Use the gsecdump utility to extract passwords.

Run PowerShell as administrator and run the command:

gsecdump-v2b5.exe -1

The result is:

What is Managed Service Accounts

The Managed Service Accounts (MSA) mechanism has been developed as the protection from such attacks in Windows Server 2008 R2.

Managed Service Accounts are managed accounts in a domain that provide automatic password management and simplified management of the participant service names including delegating control to other administrators.

Advantages of Managed Service Accounts

An automatic password change. By default a password is changed every 30 days

A complex password. A complex, automatically generated password consisting of 240 random symbols (the first half includes English letters, the second half — numerals and other symbols)

No superfluous rights

An opportunity to use one MSA on several servers (gMSA) in case when all service instances should use a single subject, e.g., for using in NLB

SPN Management

Automatic update of the SPN after the renaming

server account

dnshostname property of the server account

changing addition-aldnshostname property of the server account

changing additionalsam-accountname property of the server account

Services that support MSA:

AD LDS

SQL Server 2008 R2 SP1, 2012

MS Exchange 2010, 2013

MSA Requirements

Domain and forest level – Windows Server 2008 R2

Windows Server 2008 R2, Windows 7 (Professional, Enterprise, Ultimate) and above

Active Directory administration module for PowerShell

The installed patch KB2494158

If a forest and a domain don’t have the 2008 R2 (MSA) and 2012 (gMSA) levels, you have to increase the forest level using the command:

adprep /forestprep

And increase the domain level using the command:

adprep /domainprep

in each domain, in which you have to create and use managed service accounts.

How to Enable MSA in PowerShell

Run the cmdlet:
Import-Module ActiveDirectory

To create an MSA account, you have to run the cmdlet:
New-ADServiceAccount serviceaccount -RestrictToSingleComputer
where serviceaccount is the name of the MSA account
The parameter RestrictToSingleComputer means that MSA will be linked only to a single server. You can go to Active Directory Users and Computers and make sure that MSA has been created (for the section Managed Service Accounts to appear, you have to enable Advanced Features in the View menu of the AD snap-in).

To link MSA to the server, run the cmdlet:
Add-ADComputerServiceAccount -Identity server -ServiceAccount serviceaccount
where server is the name of the server which is associated with MSA
serviceaccount is the name of the MSA
To check if the operation has succeeded, go to Active Directory Users and Computers, then move to the server properties and check msDS-HostServiceAccount attribute

Install the managed service account on the local computer
You have to run the cmdlet:
Install-ADServiceAccount -Identity serviceaccount
where serviceaccount is the name of the MSA

Test the MSA (Windows 8.1, Windows PowerShell 4.0, Windows Server 2012 R2)
Run the cmdlet:
Test-ADServiceAccount serviceaccount
where serviceaccount is the name of the MSA
It returns the value True or False

Set to run Windows service as MSA and restart the service.
Don’t forget to put ‘$‘ at the end of the MSA name
The field Password should be left empty.

Let’s check the service account password using the gsecdump utility

Group Managed Service Accounts in Windows Server 2012

In Windows Server 2012 there appeared Group Managed Service Accounts (gMSA). They allow to link a managed account not to a single server, but to several of them.

It can become necessary, for example, in Network Load Balancing or Windows cluster.

Requirements:

Schema level – Windows Server 2012

Windows Server 2012 (R2) domain controller running Microsoft Key Distribution Service

Windows Server 2012, 2012 R2, 8, 8.1

Active Directory administration module for PowerShell

How to Enable gMSA in PowerShell

Make sure that Microsoft Key Distribution Service is on “Microsoft Key Distribution Service uses a shared secret to generate account keys. These keys are changed from time to time. Along the other attributes of the Group Managed Service Accounts the Windows Server 2012 domain controller gets a password for a key provided by key distribution services. By addressing to the Windows Server 2012 domain controller Windows Server 2012 and Windows 8 hosts can get a current and a previous passwords.”
Create a Root Key
Root Key can be created with the cmdlet:
Add-KdsRootKey
To create a new Root Key, run the following cmdlet:
Add-KdsRootKey -EffectiveImmediately
In this case the key will be available in 10 hours, until replicated.
You can also run a cmdlet:
Add-KdsRootKey -EffectiveTime ((get-data).addhours(-10))
Then the key will become available immediately (10 hours of work are saved)

Create gMSA
Run the cmdlet:
New-ADServiceAccount serviceaccount -DNSHostName tst.test.com -PrincipalsAllowedToRetrieveManagedPasswork $test
where serviceaccount is the name of the gMSA
tst.test.com is the name of the server, on which a Root Key has been created
$test is the name of the server that can address KDS to get dataYou can go to Active Directory Users and Computers and make sure that gMSA has been created (for the section Managed Service Accounts to appear, you have to enable Advanced Features in the View menu of the AD snap-in).

Install the managed service account on the local computer
You have to run the cmdlet:
Install-ADServiceAccount -Identity serviceaccount
where serviceaccount is the name of the gMSA

Test the gMSA (Windows 8.1, Windows PowerShell 4.0, Windows Server 2012 R2)
Run the cmdlet:
Test-ADServiceAccount serviceaccount
where serviceaccount is the name of the gMSA
It returns the value True or False

Set to run Windows service as gMSA and restart the service.
Don’t forget to put ‘$’ at the end of the gMSA name
The field Password should be left empty.