{"id":51453,"date":"2010-01-28T00:01:00","date_gmt":"2010-01-28T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/01\/28\/hey-scripting-guy-how-can-i-create-managed-service-accounts\/"},"modified":"2010-01-28T00:01:00","modified_gmt":"2010-01-28T00:01:00","slug":"hey-scripting-guy-how-can-i-create-managed-service-accounts","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-how-can-i-create-managed-service-accounts\/","title":{"rendered":"Hey, Scripting Guy! How Can I Create Managed Service Accounts?"},"content":{"rendered":"

 \"Bookmark<\/a><\/p>\n

 <\/p>\n

\"Hey,<\/p>\n

Hey, Scripting Guy! The pointy-headed boss is on a rampage. The problem is he has no idea why he is rampaging. This guy makes Nick Bottom<\/font><\/a> seem like Aristotle. His latest obsession concerns service accounts. He wants me to create user accounts, with names like SQL_Service_Account<\/b>, make these accounts Domain Administrators, and set their passwords so that they do not expire. I have tried telling him that such an approach is so last century, but he will not listen. I know this may not be a scripting question, but he respects you guys—<\/span>even if he will not listen to his own staff. Can you help?<\/p>\n

— KM<\/p>\n

\n

 <\/p>\n<\/p>\n

\"Hey,Hello KM, <\/p>\n

Microsoft Scripting Guy Ed Wilson here. I love the smell of the bergamot oil extract that is present in Earl Grey tea<\/font><\/a>. A fresh pot of Earl Grey tea and an ANZAC biscuit<\/font><\/a> and I am ready to swim with the sharks—quite literally as shown in the following image, which shows a shark I snapped when I was diving in Australia. <\/p>\n

\"Image<\/p>\n

\n

 <\/p>\n<\/p>\n

KM, believe it or not, your question is a scripting question. Windows Server 2008 R2 introduces the concept of the managed service account<\/font><\/a>. Managed service accounts provide a couple of benefits. Perhaps the most important benefit is you do not need to mess with resetting the passwords manually because passwords for managed service accounts are reset automatically. This provides the security benefit of new passwords with the advantage of no administrative overhead. The reason this becomes a scripting question is that there is no ability in Active Directory Users and Computers (that I have seen) to create a new service account. You will need to use Windows PowerShell. <\/p>\n

The first thing you will need to do is load the ActiveDirectory<\/b> module. <\/p>\n

For more information on the ActiveDirectory module, see Monday’s Hey, Scripting Guy! post<\/a>. <\/p>\n

To import the activedirectory<\/b> module, use the Import-Module<\/b> cmdlet and supply the name of the module. You do not need to type the entire module name because you can use wildcard characters if you wish. The only requirement is that the wildcard character combination match only one module. This is shown here:<\/p>\n

PS C:> Import-Module active*<\/p>\n

<\/font><\/span><\/p>\n

To create a new Active Directory Service Account, use the New-ADServiceAccount<\/b> cmdlet. One parameter is required: the name of the service account to be created. The default location in Active Directory for managed service accounts is the Managed Service Account container. The following example creates a new managed service account named sql-srv1<\/b> in the managed service accounts container in the NWTraders<\/b> domain:<\/p>\n

PS C:> New-ADServiceAccount -Name sql-srv1 -Path “cn=managed service accounts,dc=nwtraders,dc=com”<\/p>\n

<\/font><\/span><\/p>\n

After the command has executed, the new service account appears, as seen in the following image.<\/p>\n

\"Image<\/p>\n

\n

 <\/p>\n<\/p>\n

The previous command is kind of long, and you may wish to shorten it. The first task in shortening the length of the command is to see if there is an alias for the New-ADServiceAccount<\/b>. Using the Get-Alias<\/b> cmdlet, you get the following results:<\/p>\n

PS C:> Get-Alias -Definition New-ADServiceAccount<\/p>\n

<\/font><\/span><\/p>\n

Get-Alias : This command cannot find a matching alias because alias with definition ‘New-ADServiceAccount’ do not exist<\/p>\n

<\/font><\/span><\/p>\n

.<\/p>\n

<\/font><\/span><\/p>\n

At line:1 char:10<\/p>\n

<\/font><\/span><\/p>\n

+ Get-Alias <<<<  <\/span>-Definition New-ADServiceAccount<\/p>\n

<\/font><\/span><\/p>\n

    <\/span>+ CategoryInfo       &nbsp\n;  <\/span>: ObjectNotFound: (New-ADServiceAccount:String) [Get-Alias], ItemNotFoundException<\/p>\n

<\/font><\/span><\/p>\n

    <\/span>+ FullyQualifiedErrorId : ItemNotFoundException,Microsoft.PowerShell.Commands.GetAliasCommand<\/p>\n

<\/font><\/span><\/p>\n

\n

 <\/font><\/p>\n<\/p>\n

It appears that there is no alias for the New-ADServiceAccount<\/b>. This is curious, so you use the Get-Alias<\/b> cmdlet to see if there are any aliases for the Active Directory cmdlets. By using a wildcard character for the cmdlet definition, you can pick up aliases for cmdlets that contain the letters ad<\/b> in their name, as shown here:<\/p>\n

PS C:> Get-Alias -Definition *ad*<\/p>\n

<\/font><\/span><\/p>\n

<\/p>\n

 <\/font><\/p>\n

<\/span><\/p>\n

CommandType     <\/span>Name                                                <\/span>Definition<\/p>\n

<\/font><\/span><\/p>\n

———–     <\/span>—-                                                <\/span>———-<\/p>\n

<\/font><\/span><\/p>\n

Alias           <\/span>ac               <\/span>                                   <\/span>Add-Content<\/p>\n

<\/font><\/span><\/p>\n

Alias           <\/span>AddComputer                                         <\/span>Add-Computer<\/p>\n

<\/font><\/span><\/p>\n

Alias           <\/span>AddContent                                          <\/span>Add-Content<\/p>\n

<\/font><\/span><\/p>\n

Alias           <\/span>AddHistory                      <\/span>                    <\/span>Add-History<\/p>\n

<\/font><\/span><\/p>\n

Alias           <\/span>AddMember                                           <\/span>Add-Member<\/p>\n

<\/font><\/span><\/p>\n

Alias           <\/span>AddPSSnapin                                         <\/span>Add-PSSnapin<\/p>\n

<\/font><\/span><\/p>\n

Alias           <\/span>AddType                                         <\/span>    <\/span>Add-Type<\/p>\n

<\/font><\/span><\/p>\n

Alias           <\/span>asnp                                                <\/span>Add-PSSnapIn<\/p>\n

<\/font><\/span><\/p>\n

Alias           <\/span>ReadHost                                            <\/span>Read-Host<\/p>\n

<\/font><\/span><\/p>\n

There are no aliases created for the Active Directory cmdlets. However, this should not prevent you from creating one if you wish to do so. You could put the aliases into a module that y\nou load when you load the Active Directory cmdlets. <\/p>\n

To create a new alias, use the New-Alias<\/b> cmdlet. After the alias is created, you can use the alias to create a new service account:<\/p>\n

PS C:> New-Alias -Name adsa -Value New-ADServiceAccount<\/p>\n

<\/font><\/span><\/p>\n

PS C:> adsa test1<\/p>\n

<\/font><\/span><\/p>\n

PS C:><\/p>\n

<\/font><\/span><\/p>\n

You do not need to specify the location for the managed service account if it is to be placed in the default location. The new managed service account is shown in the following image.<\/p>\n

\"Image<\/p>\n

\n

 <\/p>\n<\/p>\n

You can specify the password, the location, and even the enabled parameter when creating a new Active Directory service account. One thing to keep in mind is that the password must be a secure string. One way to create a secure string is to use the ConvertTo-SecureString<\/b> cmdlet. If you type in a plain text string to the ConvertTo-SecureString<\/b> cmdlet, you need to specify that it is plain text by using the –asplaintext<\/b> parameter and then you need to use the –force<\/b> parameter to tell the cmdlet you know what you are doing, and you really do want to use the plain text string as a secure string. By default, service accounts are created with a 240-character randomly generated password. It is possible that the password you specify will not meet complexity requirements. The account will still be created, but it will not be enabled until you have set a password that meets complexity requirements. The following command creates a new service account named sql-srv2<\/b>. It is a single command that will probably wrap in your Windows PowerShell console, unless you have a widescreen monitor and have increased the dimensions of your Windows PowerShell console. <\/p>\n

PS C:> New-ADServiceAccount -Name sql-srv2 -Path “cn=managed service accounts,dc=nwtraders,dc=com” -accountPassword (ConvertTo-SecureString -AsPlainText “P@ssword1” -Force) -enabled $True<\/p>\n

<\/font><\/span><\/p>\n

If you wish the service account to be trusted for Kerberos delegation, use the –TrustedForDelegation<\/b> parameter and set its value to $true<\/b>. When a service account is trusted for delegation, it is permitted to assume the identity of a client requesting the service. The single line of code to create a trusted service account is seen here:<\/p>\n

PS C:> New-ADServiceAccount -Name sql-srv3 -Path “cn=managed service accounts,dc=nwtraders,dc=com” -accountPassword (ConvertTo-SecureString -AsPlainText “P@ssword1” -Force) -enabled $True -TrustedForDelegation $true<\/p>\n

<\/font><\/span><\/p>\n

As a best practice, I recommend supplying a description for any service account that you create. This will help you to know why the account was created, what it is to be used for, and when it can be safely deleted. To specify a description, use the description<\/b> property:<\/p>\n

PS C:> New-ADServiceAccount -Name sql-srv4 -Path “cn=managed service accounts,dc=nwtraders,dc=com” -accountPassword (ConvertTo-SecureString -AsPlainText “P@ssword1” -Force) -enabled $True -TrustedForDelegation $true -description “trusted SQL account”<\/p>\n

<\/font><\/span><\/p>\n

PS C:><\/p>\n

<\/font><\/span><\/p>\n

After all of the accounts have been created, you can use Active Directory Users and Computers to view the newly created accounts. This is seen in the following image.<\/p>\n

\"Image<\/p>\n

\n

 <\/p>\n<\/p>\n

KM, that is all there is to using the Active Directory cmdlets to create a managed service account. This also concludes Active Directory Week. Join us tomorrow for Quick-Hits Friday. <\/p>\n

If you want to know exactly what we will be looking at tomorrow, follow us on Twitter<\/a> or Facebook<\/font><\/a>. If you have any questions, send e-mail to us at scripter@microsoft.com<\/font><\/a> or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

\n

 <\/p>\n<\/p>\n

Ed Wilson and Craig Liebendorfer, Scripting Guys<\/p>\n

<\/span><\/b><\/p>\n

<\/span><\/b> <\/p>\n","protected":false},"excerpt":{"rendered":"

    Hey, Scripting Guy! The pointy-headed boss is on a rampage. The problem is he has no idea why he is rampaging. This guy makes Nick Bottom seem like Aristotle. His latest obsession concerns service accounts. He wants me to create user accounts, with names like SQL_Service_Account, make these accounts Domain Administrators, and set […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,20,45],"class_list":["post-51453","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-user-accounts","tag-windows-powershell"],"acf":[],"blog_post_summary":"

    Hey, Scripting Guy! The pointy-headed boss is on a rampage. The problem is he has no idea why he is rampaging. This guy makes Nick Bottom seem like Aristotle. His latest obsession concerns service accounts. He wants me to create user accounts, with names like SQL_Service_Account, make these accounts Domain Administrators, and set […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/51453","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=51453"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/51453\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=51453"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=51453"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=51453"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}