Service and shared accounts: inventory, ownership and managed passwords

Skills you'll practise

• Build a service account inventory with owner, purpose, hosts, rights and password age, and rank its risks
• Choose between a virtual account, sMSA, gMSA and a user account using where the service runs and who manages the password
• Create, install, test and retire a gMSA, including the KDS root key and the hosts allowed to retrieve its password
• Recognise gMSA limits: interval set only at creation, forest-unique names, failover clusters and encryption types
• Control shared accounts: individual accounts first, vaulting, and changing secrets when someone leaves

Course outline

1. 1.Service and shared accountsVideo · 2 min
2. 2.Know your non-person accountsLesson · 20 min
3. 3.Choosing a principal, and running a gMSALesson · 26 min
4. 4.Shared accounts and migrating old servicesLesson · 19 min
5. 5.Service and shared accounts: inventory, ownership and managed passwords: knowledge checkKnowledge check · 18 questions
6. 6.Final exam9 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• Microsoft Learn: Group Managed Service Accounts overview
• Microsoft Learn: Manage Group Managed Service Accounts (principal types, prerequisites, New-ADServiceAccount, Install/Test/Uninstall)
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations (AC-2 Account Management, AC-2(3), AC-5, AC-6, AC-6(7), PS-4, PS-5)