Many of the IT environments have so called security driven approach. Every time I hear that something has to be implemented it is because security said so. Don’t get me wrong - by all means I like to be secure and compliant. In my opinion there should be balance between Security and Costs.

I have found very nice chart which shows that.

In Today post I will show you how to configure vCenter Server to work with MSA.

Managed Service Account and Group Managed Service Account - what is that?

Managed Service Account was introduced by Microsoft with release of Windows Server 2008 R2.The best description is from Microsoft Technet Article.

The managed service account is designed to provide crucial applications such as IIS with the isolation of their own domain accounts, while eliminating the need for an administrator to manually administer the service principal name (SPN) and credentials for these accounts. It is a managed domain accounts that provides automatic password management and simplified SPN management. Virtual accounts are “managed local accounts” that can use a computer’s credentials to access network resources.

Group Managed Service Accounts was released with Windows Server 2012.

The group Managed Service Account provides the same functionality within the domain but also extends that functionality over multiple servers.

Unfortunately MSA was not ideal solution to most user problems due to limitations. With release of gMSA many more use cases might be found to use them. See table below with supported applications with MSA and gMSA supported applications.

Which MSA should I use then some of you might ask. That depends how will you plan your environment. If you want to use same MSA account on several computers than you should use gMSA. If you will use MSA account on one server than you should use MSA.

Managed Service Account and Group Managed Service Account- prerequisites

Managed Service Accounts require the Active Directory schema to be updated to the Server 2008 R2 version.

Group Managed Service Accounts require the Active Directory schema to be updated to the Server 2012 version.

In my test lab I will show you how to run vCenter Server services and Microsoft SQL Server using Managed Service Accounts.

Managed Service Account creation

1. Open PowerShell and import module Active Directory.

Import-Module ActiveDirectory

2. To create a standalone managed service account which is linked to a specific computer, we will use the -RestrictToSingleComputer parameter in New-AdServiceAccount command.

New-ADServiceAccount -Name vmwareafd -RestrictToSingleComputer

3. In the next step we will associate newly created MSA account to computer.

Add-ADComputerServiceAccount -Identity vcenter -ServiceAccount vmwareafd

4. On the target computer where we will install MSA open PowerShell, install Active Directory module (if it is not installed previously).

Import-Module ServerManager
Add-WindowsFeature Rsat-AD-PowerShell

5. Import Active Directory module (see first step) and install MSA account.

Install-ADServiceAccount vmafd

6. Last step is to change log on account. Remember to clear password and Confirm password fields.
7. Newly added account to service will be granted Log On As A Service right.

VMware vCenter Server Services

Below you can find all vCenter Server services. In third column you can see MSA account names.

The next step is to import all MSA accounts to target computer. I simply added accounts using Computer Management.

Once we have all accounts added to local Administrators groups we will stop all vCenter Services and replace user accounts associated to each service.

I had to add WOJCIEH\vminvservice$, WOJCIEH\vmvpxd$ account as security login to vCenter Server and MSDB databases. This is needed to start vCenter Server service. If you will not do it you will see errors like this.

After all changes and some tweaking we have fully functional vCenter Server running with MSA accounts.

Virtual Accounts

However with vCenter Server 6.0 new concept of virtual accounts was introduced. Following VMware KB explains this concept: Use of virtual accounts for services on a Windows vCenter Server 6.0 (2124709).From VMware KB we see that following services are used as virtual accounts.

As VMware guru you have to consider all cons and pros of each solution and decide to go with MSA accounts or not.

Summary

It took me a while to check prepare this post but I am happy that I could prove that MSA accounts are working as well with vCenter Server. What is unknown if VMware Support will help you if you are using MSA accounts. If you wish I can check as well if Group Managed Accounts are working with vCenter Server 6.0.