Create Service Account (gMSA)

This guide walks you through the creation and configuration of a Group Managed Service Account (gMSA) for use with Identity Stack Agent.

A gMSA is an AD account type where Active Directory manages the password itself. Identity Stack Agent uses the gMSA to connect to Active Directory without a manually maintained password.

Prerequisites

The commands below are run in PowerShell as administrator on a domain-joined server, and they require permissions to create service accounts in the domain (typically Domain Admin).

1. Prepare the environment

Ensure the RSAT tools are installed on a domain-joined server:

Add-WindowsFeature RSAT-AD-PowerShell

2. Create a KDS Root Key (one-time forest-wide setup)

Run this once per AD forest to allow secure password distribution to gMSAs:

Add-KdsRootKey -EffectiveImmediately

⚠️ Note: Despite the name -EffectiveImmediately, the key only becomes effective after approximately 10 hours, allowing replication to all domain controllers to complete. In lab environments, where you cannot wait 10 hours, the key can be backdated:

Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10))

3. Create the gMSA

Create a Group Managed Service Account named is-agent. The command also allows the current server to retrieve the password:

$dnsHostname = [System.Net.Dns]::GetHostByName($env:COMPUTERNAME).HostName
$serverName = "$($env:COMPUTERNAME)$"

New-ADServiceAccount `
  -Name "is-agent" `
  -DNSHostName $dnsHostname `
  -PrincipalsAllowedToRetrieveManagedPassword $serverName

Note: If Identity Stack Agent runs on multiple host machines, all machines must be specified in -PrincipalsAllowedToRetrieveManagedPassword, e.g. "SERVER1$","SERVER2$".

4. Install the gMSA on the target server

Run the following on the server that will run the Windows service:

Install-ADServiceAccount -Identity is-agent
Test-ADServiceAccount -Identity is-agent  # Should return True

If Test-ADServiceAccount returns True, the gMSA is ready for use.

Next steps

Continue with Grant permissions to the gMSA.