Windows Managed Service Accounts and gMSA PowerShell Cheat Sheet

$server = 'dc01.corp.example.com'
$PSVersionTable | Select-Object PSEdition, PSVersion
Get-Module -ListAvailable ActiveDirectory | Select-Object Name, Version, Path
Get-ADForest -Server $server | Select-Object Name, ForestMode, SchemaMaster, Domains
Get-ADDomain -Server $server | Select-Object DNSRoot, DomainMode, PDCEmulator
Get-ADDomainController -Identity $server |
  Select-Object HostName, OperatingSystem, Site, IsReadOnly, OperationMasterRoles

Note: Treat the reported modes as eligibility inputs, not proof that the schema, replication, KDS, host, and application requirements are all satisfied.

Import-Module Kds
Get-KdsRootKey |
  Select-Object KeyId, EffectiveTime, CreationTime, DomainController
Get-WinEvent -FilterHashtable @{
  LogName = 'Microsoft-Windows-KdsSvc/Operational'
  Id = 4004
} -MaxEvents 10 | Select-Object TimeCreated, Id, LevelDisplayName, Message

# Run once only under an approved forest change, then allow up to ten hours.
# Add-KdsRootKey -EffectiveImmediately

Note: Add-KdsRootKey does not provide a safe simulation of forest-wide effects. Never uncomment it without approval, and never create another root merely because an existing deployment is not yet effective.

$server = 'dc01.corp.example.com'
$hostGroup = Get-ADGroup -Identity 'GG-gmsaFinance-Hosts' -Server $server
$hostAccount = Get-ADComputer -Identity 'APP01' -Server $server
$hostGroup, $hostAccount |
  Select-Object Name, ObjectClass, ObjectGUID, SID, DistinguishedName

Add-ADGroupMember -Identity $hostGroup.ObjectGUID `
  -Members $hostAccount.ObjectGUID -Server $server -WhatIf
Set-ADServiceAccount -Identity 'gmsaFinance' `
  -PrincipalsAllowedToRetrieveManagedPassword $hostGroup.ObjectGUID `
  -Server $server -WhatIf

Note: WhatIf previews supported directory mutations only. It does not evaluate effective ACLs, replication, group-token refresh, host compromise risk, or whether every current consumer is represented.

$server = 'dc01.corp.example.com'
$hosts = Get-ADGroup -Identity 'GG-gmsaFinance-Hosts' -Server $server
$params = @{
  Name = 'gmsaFinance'
  DNSHostName = 'finance.corp.example.com'
  Description = 'Finance API identity; owner Finance Platform; CHG-2042'
  PrincipalsAllowedToRetrieveManagedPassword = $hosts.ObjectGUID
  ServicePrincipalNames = @('HTTP/finance.corp.example.com')
  KerberosEncryptionType = @('AES128','AES256')
  ManagedPasswordIntervalInDays = 30
  Server = $server
}
$existing = Get-ADServiceAccount -Identity $params.Name -Server $server `
  -Properties DNSHostName,ServicePrincipalNames,KerberosEncryptionType,`
    ManagedPasswordIntervalInDays,PrincipalsAllowedToRetrieveManagedPassword `
  -ErrorAction SilentlyContinue
if ($existing) {
  $existing | Select-Object Name,SamAccountName,ObjectGUID,DNSHostName,Enabled,`
    ServicePrincipalNames,KerberosEncryptionType,ManagedPasswordIntervalInDays,`
    PrincipalsAllowedToRetrieveManagedPassword
} else {
  New-ADServiceAccount @params -WhatIf
}

$server = 'dc01.corp.example.com'
$existing = Get-ADServiceAccount -Identity 'msaLegacy' -Server $server `
  -ErrorAction SilentlyContinue
if ($existing) {
  Add-ADComputerServiceAccount -Identity 'APP01' `
    -ServiceAccount $existing -Server $server -WhatIf
} else {
  New-ADServiceAccount -Name 'msaLegacy' -RestrictToSingleComputer `
    -Description 'Single-host legacy agent on APP01' -Server $server -WhatIf
}

Note: WhatIf does not create an object for a later command in the same script. Execute and verify the approved creation before previewing association. Do not deploy an sMSA to a farm.

$account = 'gmsaFinance'
$env:COMPUTERNAME
Test-ComputerSecureChannel -Verbose
Resolve-DnsName 'dc01.corp.example.com'
Install-ADServiceAccount -Identity $account -WhatIf

# After the approved installation is executed:
Test-ADServiceAccount -Identity $account
Get-ADServiceAccount -Identity $account |
  Select-Object Name, SamAccountName, SID, Enabled

Note: Test on the actual workload host. A successful result on an administrator workstation proves only that workstation's eligibility.

$serviceName = 'FinanceWorker'
$before = Get-CimInstance Win32_Service -Filter "Name='$serviceName'"
$before | Select-Object Name, StartName, StartMode, State, PathName
Test-ADServiceAccount -Identity 'gmsaFinance'

# Approved maintenance window: preserve rollback data before changing identity.
sc.exe config $serviceName obj= 'CORP\gmsaFinance$' password= ''
Get-CimInstance Win32_Service -Filter "Name='$serviceName'" |
  Select-Object Name, StartName, State
sc.exe qmanagedaccount $serviceName

Note: sc.exe has no WhatIf and changes the Service Control Manager database immediately. Stop or drain the instance as the vendor requires, then restart and run an application-level authentication test.

$principal = New-ScheduledTaskPrincipal `
  -UserId 'CORP\gmsaFinance$' -LogonType Password -RunLevel Limited
$action = New-ScheduledTaskAction `
  -Execute 'C:\Program Files\Finance\Reconcile.exe'
$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable
$task = New-ScheduledTask -Action $action -Principal $principal -Settings $settings
$task | Select-Object -ExpandProperty Principal
# Register-ScheduledTask -TaskName 'Finance-Reconcile' -InputObject $task

Note: Registration is intentionally omitted from the example because it mutates Task Scheduler. Add bounded triggers, execution limits, working-directory behavior, and task-history monitoring before deployment.

Import-Module WebAdministration
Get-ItemProperty 'IIS:\AppPools\FinanceApi' -Name processModel |
  Select-Object identityType, userName, loadUserProfile

# During an approved drain, set SpecificUser to CORP\gmsaFinance$ with no password
# through IIS Manager or a tested AppCmd/WebAdministration deployment, then recycle
# only this pool and verify Windows authentication plus every downstream dependency.

Note: Do not place a password placeholder in source control. Export a protected IIS configuration backup and confirm the application vendor supports gMSA before changing the pool.

$server = 'dc2025.corp.example.com'
$machine = Get-ADComputer -Identity 'APP01' -Server $server
$dmsa = Get-ADServiceAccount -Identity 'dmsaFinance' -Server $server `
  -Properties 'msDS-DelegatedMSAState',PrincipalsAllowedToRetrieveManagedPassword `
  -ErrorAction SilentlyContinue
if (-not $dmsa) {
  New-ADServiceAccount -Name 'dmsaFinance' `
    -DNSHostName 'dmsaFinance.corp.example.com' `
    -CreateDelegatedServiceAccount -KerberosEncryptionType AES256 `
    -Server $server -WhatIf
} else {
  Set-ADServiceAccount -Identity $dmsa `
    -PrincipalsAllowedToRetrieveManagedPassword $machine.ObjectGUID `
    -Server $server -WhatIf
  Set-ADServiceAccount -Identity $dmsa `
    -Replace @{'msDS-DelegatedMSAState' = 3} -Server $server -WhatIf
  $dmsa | Select-Object Name,ObjectGUID,Enabled,`
    'msDS-DelegatedMSAState',PrincipalsAllowedToRetrieveManagedPassword
}

Note: WhatIf does not create the dMSA for subsequent steps. Execute and verify each approved mutation before previewing the next; deploy DelegatedMSAEnabled=1 through governed client policy and validate the final state before binding a workload.

Get-CredentialSpec | Select-Object Name, Path
Get-Content 'C:\ProgramData\docker\CredentialSpecs\finance.json' -Raw |
  ConvertFrom-Json | Select-Object -ExpandProperty ActiveDirectoryConfig

Note: A credential spec contains account metadata rather than the managed password, but it is still security-sensitive configuration. Verify its source, ACL, orchestrator distribution, eligible nodes, and gMSA SPNs.

$server = 'dc01.corp.example.com'
$account = Get-ADServiceAccount -Identity 'gmsaFinance' -Server $server `
  -Properties DNSHostName,ServicePrincipalNames,KerberosEncryptionType,`
    PrincipalsAllowedToRetrieveManagedPassword,PasswordLastSet
$account | Select-Object Name,SamAccountName,SID,DNSHostName,Enabled,PasswordLastSet,`
  KerberosEncryptionType,ServicePrincipalNames,PrincipalsAllowedToRetrieveManagedPassword
Test-ComputerSecureChannel -Verbose
Test-ADServiceAccount -Identity $account
setspn.exe -Q 'HTTP/finance.corp.example.com'
Get-CimInstance Win32_Service -Filter "Name='FinanceWorker'" |
  Select-Object Name, StartName, State, ExitCode
Get-WinEvent -LogName 'Microsoft-Windows-Security-Kerberos/Operational' `
  -MaxEvents 100 | Select-Object TimeCreated, Id, LevelDisplayName, Message

Note: Do not query or serialize msDS-ManagedPassword. Redact domain topology, SIDs, hostnames, and event data before attaching diagnostics outside approved administrative systems.

$server = 'dc01.corp.example.com'
$account = Get-ADServiceAccount -Identity 'gmsaFinance' -Server $server `
  -Properties ServicePrincipalNames,PrincipalsAllowedToRetrieveManagedPassword,`
    ManagedPasswordIntervalInDays,PasswordLastSet
$account | Select-Object Name,ObjectGUID,SID,Enabled,PasswordLastSet,`
  ManagedPasswordIntervalInDays,ServicePrincipalNames,`
  PrincipalsAllowedToRetrieveManagedPassword
Get-CimInstance Win32_Service |
  Where-Object StartName -eq 'CORP\gmsaFinance$' |
  Select-Object Name, StartName, State, PathName
Get-ScheduledTask | Where-Object {$_.Principal.UserId -eq 'CORP\gmsaFinance$'} |
  Select-Object TaskPath, TaskName, State

Uninstall-ADServiceAccount -Identity $account -WhatIf
Remove-ADServiceAccount -Identity $account.ObjectGUID -Server $server -WhatIf

Note: Run local consumer discovery on every eligible host. WhatIf does not find application-specific references, revoke resource permissions, delete SPNs safely, or prove that rollback is no longer needed.