How to use a Managed Service Account in ADManager Plus

Last updated on:

In this article:

Objective

This article explains how to configure a Managed Service Account (MSA) or group Managed Service Account (gMSA) to run ManageEngine ADManager Plus. This configuration helps replace traditional service accounts with automatically managed credentials, strengthening least-privilege and credential hygiene practices.

MSAs and gMSAs use random passwords that are generated, stored, and automatically rotated by Active Directory (AD), reducing the risks associated with static service account credentials. An MSA is tied to a single server, while a gMSA can be used across multiple servers.

Prerequisites

Deployment mode: ADManager Plus must be installed and run as a Windows service. An MSA and gMSA can only be used in this mode.

Domain configuration: The MSA or gMSA option can be applied only when a Domain Admin or user account credential was not provided during domain configuration. If you have already configured the domain with explicit credentials, the service account cannot be switched to an MSA or gMSA.

MSA or gMSA availability: An MSA or gMSA must already exist in AD. These are created in AD using PowerShell (for example, the New-ADServiceAccount cmdlet) and installed on the target server. gMSAs require the domain and forest functional levels to support them.

Permissions: The MSA or gMSA must have sufficient permissions to carry out the tasks you intend to perform in ADManager Plus. Refer to our permissions setup guide for the exact permissions required for AD account configuration in ADManager Plus.

Steps to configure an MSA or gMSA as the ADManager Plus service account

Once the MSA or gMSA exists in AD and has the required permissions, assign it as the sign-in account for the ADManager Plus service:

  1. Stop ADManager Plus.
  2. Open Windows Service Manager (Services.msc).
  3. Right-click ManageEngine ADManager Plus and click Properties.
  4. Navigate to the Log On tab and select This Account.
  5. Browse to and locate the MSA or gMSA account you would like to use, then click OK.
  6. Start ADManager Plus as a service.

Note: When entering a managed service account in the This Account field, append a dollar sign to the account name (for example, DOMAIN\svc-admp$) and leave the password fields blank since the password is managed by AD.

Validation and confirmation

After starting the service under the MSA or gMSA, confirm the change took effect and that ADManager Plus can operate normally:

  • In Services.msc, verify that the ManageEngine ADManager Plus service is running and that its Log On As column shows the MSA or gMSA account.
  • Log in to the ADManager Plus console and run a routine report or management action to confirm the account has the permissions it needs.
  • If a task fails, cross-check the account's rights against the minimum permission requirements listed in our permissions setup guide.

Limitations of using an MSA or gMSA in ADManager Plus

Running ADManager Plus under an MSA or gMSA has clear security advantages, but a few management tasks are not supported with this account type:

  • Exchange and Skype for Business management tasks cannot be performed
  • GPOs cannot be force updated
  • Users and groups cannot be migrated
  • Resultant Set of Policy (RSoP) and GPO Modeling reports cannot be updated

Tips

  • Choose a gMSA over an MSA when ADManager Plus runs on more than one server since only a gMSA can be shared across a cluster.
  • Grant the account only the permissions it needs for your intended tasks, following the least-privilege principle rather than assigning broad Domain Admin rights by default.
  • Confirm that the account's 30-day automatic rotation is functioning by periodically verifying that the service continues to start without manual credential updates.

Related topics and articles

What are AD service accounts?

Minimum permissions required for AD account configuration in ADManager Plus

AD management with ADManager Plus

What is AD and how does it work?

FAQs

1. What is a gMSA?

gMSA stands for group Managed Service Account. It is a managed AD account in which the password is generated and rotated automatically by Windows. Unlike an MSA, it can be used by services running across multiple servers.

2. What is the difference between an MSA and a gMSA?

Both are managed service accounts with automatic password management. An MSA is scoped to a single server, while a gMSA can be shared by services running on multiple servers or a cluster.

3. Can I use an MSA or gMSA for the ADManager Plus service account?

Yes, provided that ADManager Plus is run as a service and no Domain Admin or user credential was supplied during domain configuration. Assign the account through the service's Log On tab as described in the instructions above.