What is a group managed service account?
A group managed service account (gMSA) is a type of Active Directory account built for Windows services, scheduled tasks and IIS application pools. Introduced in Windows Server 2012, it solves the oldest service account problem: a password that someone typed once, wrote down, and never changed because changing it would break every server using it. With a gMSA, the domain generates the password, changes it on a schedule and hands the current value only to the computers allowed to use the account. No administrator ever sees it.
How the password is managed
Domain controllers run the Key Distribution Service (KDS), which derives each gMSA's password from a forest-wide root key and details of the account. The password is long and random, and it changes automatically every 30 days by default; the interval is chosen when the account is created. Each gMSA carries a list of principals permitted to retrieve the password, normally a security group containing the servers that run the service. When one of those servers needs to authenticate, it asks a domain controller for the current password. A server outside the group gets nothing.
Because every authorized server fetches the new password on its own, rotation causes no outage. That is the difference from a conventional account, where a password change means updating every service by hand.
Example: creating and using a gMSA
The forest needs a KDS root key once, created with Add-KdsRootKey; domain controllers wait up to 10 hours after it is created, to allow replication, before they will use it. An administrator then creates the account and scopes it to a group of print servers:
New-ADServiceAccount -Name gmsa-print -DNSHostName gmsa-print.contoso.local -PrincipalsAllowedToRetrieveManagedPassword PrintServers -ManagedPasswordIntervalInDays 30
On each print server, Install-ADServiceAccount gmsa-print installs it and Test-ADServiceAccount gmsa-print should return True. The service is then set to log on as CONTOSO\gmsa-print$ with the password fields left empty; the trailing dollar sign is part of the name, as it is for computer accounts.
What a gMSA does and doesn't fix
A gMSA removes human knowledge of the password, ends passwords that never expire, and defeats Kerberoasting in practice: an attacker can still request a service ticket for the account, but cracking a long random password offline isn't feasible. It does not limit what the account can do. A gMSA added to Domain Admins is still a domain admin, so it should get only the rights its service needs and be denied interactive logon. Its password is also only as safe as the group allowed to retrieve it. Anyone who can add a computer to that group, or who gains administrator rights on a member server, can obtain the password, so the group and its members need tight control. Some older applications can't run under a gMSA and still need a vaulted, regularly rotated password.
gMSA vs. other service account options
- Standalone managed service account (sMSA): the Windows Server 2008 R2 predecessor; it also rotates its own password but works on only one computer.
- Conventional domain account: a password set and changed by people, often marked never to expire; the weakest option.
- Cloud managed identities and IAM roles: the cloud equivalent, issuing short-lived credentials to a workload instead of a stored secret.
- LAPS: rotates local administrator passwords on individual machines; it is not a service account solution.
Group managed service account on the CompTIA Security+ exam
gMSAs are new to SY0-801 and fall under objective 3.2, which covers managing the security architecture, including how identities are built into it. Wording such as "the service account password must change automatically", "no administrator should know the service account's password" or "the same service runs on a farm of Windows servers" points to a gMSA. Distractors include a standalone managed service account, which works on one server only; setting the password to never expire; enabling MFA, which a service can't complete; LAPS; and a shared administrator account.