Skip to content

Instantly share code, notes, and snippets.

@jibinpb
Last active September 30, 2019 23:15
Show Gist options
  • Save jibinpb/bbdef6229e7c641bf1f66ae3cb37dc90 to your computer and use it in GitHub Desktop.
Save jibinpb/bbdef6229e7c641bf1f66ae3cb37dc90 to your computer and use it in GitHub Desktop.
Create gMSA for Windows Servers
Import-module activedirectory
$gMSAName = 'gMSA_Account_Name' ## Replace this value with new gMSA Name
$serverList = 'Server001','Server002','Server003','Server004','Server005' ## Replace with Server Names
$adOU = 'ou=Managed Service Accounts,OU=Service Accounts,DC=your_company,DC=com' ## Replace with actual AD OU
## Checking whether organizational unit exists, if not create it.
$ous = dsquery ou "$adOU"
if ($ous.count -eq 0) {
dsadd ou "$adOU"
}
## Create a Group Managed Service Account
$NameOfServersAccountIsToBeUsedOn = $serverList.ForEach{ return (Get-ADComputer $_) }
Write-Output $NameOfServersAccountIsToBeUsedOn
##Creating the gMSA
New-ADServiceAccount -Name $gMSAName -Path "$adOU" -DNSHostName "$gMSAName.your_company.com" -PrincipalsAllowedToRetrieveManagedPassword $NameOfServersAccountIsToBeUsedOn -TrustedForDelegation $true
@lavahot
Copy link

lavahot commented Sep 30, 2019

You should make line 18 a splat for readability.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment