OPManager and GMSA

OPManager and GMSA

GMSA is a service account which initially has a blank password but as you use it for a account it gets a complex password from Key Distribution Service (KDS) and keeps on renewing it momentarily which makes it highly secure.
Lot of application like task scheduler or Opmanager do not allow to enter blank password to start with.

To counter this for task scheduler we use Powershell like below :-

To use the PowerShell, you need to define an Action (what), a Trigger(when) and a Principal(under which identity):

$action = New-ScheduledTaskAction  "c:\scripts\backup.cmd"
$trigger = New-ScheduledTaskTrigger -At 23:00 -Daily
$principal = New-ScheduledTaskPrincipal -UserID child\myAdminAccount$ -LogonType Password

After the –LogonType switch you type the word Password, and not an actual password.  This tells the scheduled task to retrieve the actual password for the gMSA from a domain controller.
Now you plug these three variables into a Register-ScheduledTask cmdlet

Register-ScheduledTask myAdminTask –Action $action –Trigger $trigger –Principal $principal


Is there anything like this for OpManager Service account also, which we can use..?

Any custom script like this which exists or you can develop that can make use of GMSA..?


                New to ADManager Plus?

                  New to ADSelfService Plus?