Contents
What benefit do managed service accounts provide compared to standard user accounts used for services?
The benefits of a managed service account include heightened security and ease of maintenance. Moreover, these accounts can run services on a computer with the possibility of connecting to network services as a specific user principal.
Should service accounts passwords expire?
As a result of these bad practices, service account and application passwords are often set to never expire and subsequently remain unchanged year after year. Failing to change service account passwords represents a significant security risk because service accounts often have access to sensitive data and systems.
Can a service account be used on more than one computer?
One managed service account can be used for services on a single computer. Managed service accounts cannot be shared between multiple computers, and they cannot be used in server clusters where a service is replicated on multiple cluster nodes.
What is a standalone managed service account ( SMSA )?
Standalone Managed Service Accounts (sMSAs) are managed domain accounts used to secure one or more services running on a server. They cannot be reused across multiple servers. sMSAs provide automatic password management, simplified service principal name (SPN) management, and the ability to delegate management to other administrators.
What makes a GMSA account more secure than a user account?
Service and domain administrators are required to observe strong password management processes to help keep the account secure. gMSA accounts are inherently more secure than standard user accounts, which require ongoing password management.
What can group managed service accounts be used for?
Group managed service accounts (gMSAs) are managed domain accounts that are used for securing services. gMSAs can run on a single server, or in a server farm, such as systems behind a Network Load Balancer (NLB) or an Internet Information Services (IIS) server.