AD Assessment and GPO Validation server configuration with gMSA

Overview

This guide provides step-by-step instructions for configuring an on-premises Remedio Server to use a Group Managed Service Account (gMSA).

Follow these guidelines to ensure all Remedio components function correctly with the gMSA.

Guidelines / Prerequisites

Install Remedio AD Assesment and/or GPO Validation with a regular user account (do not use the gMSA for initial installation).
1. If the server is yet installed, please refer to this guide to setup and install AD Assessor and/or GPO Validation.
Create a security group that will be allowed to retrieve the managed password for the gMSA.
Create and install the gMSA.
Reconfigure GYTPOL Tasks to use the gMSA.
Reconfigure GYTPOL AD Domain Agent service to use the gMSA.

Creating the Security Group (GroupName)

A security group is required to define which computers can retrieve the gMSA's managed password and use it.

This step is crucial before creating the gMSA.

Create the Security Group

Open Active Directory Users and Computers (ADUC) on a Domain Controller.
1. You can also perform this on the dsRequester server, provided the necessary features are installed as specified in the prerequisites.
Right-click the desired OU, select New > Group, and name it (e.g., gMSA-Remedio-Servers).
Set the group type to Security and click OK.
Enter the computer accounts that should have access to the gMSA under the Members tab.
1. Usually, this will include only the dsRequester server.

Create the gMSA

Identify the name of the gMSA you want to create. For example, Remedio_gMSA.
Determine the group or computer accounts that will have access to use this gMSA.
Open PowerShell as an Administrator on a Domain Controller.
1. You can also perform this on the Remedio Server, provided the necessary features are installed as specified in the prerequisites.
Run the following command to create the gMSA:

New-ADServiceAccount -Name "Remedio_gMSA" -DNSHostName "domain.local" -PrincipalsAllowedToRetrieveManagedPassword "GroupName"

Replace Remedio_gMSA with your desired gMSA name.
Replace domain.local with your domain name.
Replace GroupName with the name of the group you created (e.g., gMSA-Remedio-Servers).
- The PrincipalsAllowedToRetrieveManagedPassword parameter ensures that only members of the specified group can access the gMSA's credentials. This adds a layer of security and limits access to specific computers or services.

Verify the creation of the gMSA account with:

Get-ADServiceAccount "Remedio_gMSA"

Install the gMSA on the Remedio Server

Log in to the Remedio dsRequester server.
Open PowerShell as an Administrator.
Install the gMSA using:
Install-ADServiceAccount -Identity "Remedio_gMSA"
Test the gMSA installation. A True result indicates that the account is ready to use.
Test-ADServiceAccount "Remedio_gMSA"

Add the gMSA to Local Administrators group and Logon as a Batch/Service Privilege on the server

Granting gMSA Local Administrator Privileges

Add the gMSA to the local Administrators group using Powershell as Administrator. Replace domain.local\Remedio_gMSA$ with the gMSA's name and domain.
Add-LocalGroupMember -Group "Administrators" -Member "domain.local\Remedio_gMSA$"

The $ is required at the end of the gMSA name.

Adding the gMSA to "Log on as a Batch Job" and "Log on as a Service" Policy on the server

The "Log on as a batch job" and "Log on as a service" privileges allow the gMSA to execute scheduled tasks, batch processes, and run Windows services under the managed account context. Here's how to grant these privileges:

Open Local Security Policy:
1. Press Win + R, type secpol.msc, and press Enter.
Locate the Policy:
1. Go to Security Settings > Local Policies > User Rights Assignment.
  1. Double-click Log on as a batch job > Add User or Group > Advanced > Find Now > select domain.local\Remedio_gMSA$ > OK.
  2. Double-click Log on as a service > Add User or Group > repeat the same selection > OK.

The $ is required at the end of the gMSA name.

Apply Changes:
1. Click Apply > OK to save and close.

Adding the gMSA to the "Performance Log Users" Group in the Domain

Open Active Directory Users and Computers on the dsRequester Server:
- Press Win + R, type dsa.msc, and press Enter.
Locate the Group:
- Navigate to the Built-in container or the location of the Performance Log Users group.
Add the gMSA:
- Double-click Performance Log Users and go to the Members tab.
- Click Add > Advanced > Find Now.
- Select Domain.local\Remedio_gMSA$ and click OK.
Apply Changes:
- Click Apply > OK to save and close.

Reconfigure Remedio Tasks to use the gMSA

Update Scheduled Tasks:

Update all gytpolServer scheduled tasks (3 in total) to run under the gMSA.

Ensure all tasks are executing as the user who originally installed the dsRequester (not the gMSA), following the instructions in Prerequisites Step 1.

Follow these steps to use the script (be sure to modify the gMSA name as needed):

Open PowerShell ISE as an Administrator.
Copy and paste the script into the editor.
Run the script and verify the results.

# Define the gMSA Name (Hardcoded)
$gMSAName = "Remedio_gMSA$" # Include the $ suffix for the gMSA

# Set the Run Level
$runLevel = "Highest" # Options: Highest, Limited, etc.

# Array of Task Names
$taskNames = @("gytpolServer", "gytpolServerDaily", "gytpolServerWeekly")

# Loop through each task and update the principal
foreach ($taskName in $taskNames) {
    # Create the Scheduled Task Principal
    $principal = New-ScheduledTaskPrincipal -UserID $gMSAName -LogonType Password -RunLevel $runLevel

    # Update the Scheduled Task with the new Principal
    Set-ScheduledTask -TaskName $taskName -Principal $principal

    Write-Host "Updated task: $taskName with gMSA: $gMSAName"
}

After the script runs successfully, the following output should appear on your screen:

Manually execute the tasks by right-clicking on them and selecting Run.

Verify that they remain in the "Running" status and do not terminate immediately.

Reconfigure GYTPOL AD Domain Agent service to use the gMSA

Open the Windows Services console by running services.msc.
Locate the GYTPOL AD Domain Agent service, right-click it, and select Properties.
In the Log On tab, select This account and enter the Group Managed Service Account (gMSA) in the format domain.local\gMSAName$. Ensure the account name includes the trailing $ character. Leave both password fields blank.
Click Apply and OK, then restart the service for the changes to take effect.