Thread by @NathanMcNulty

You really should use (g)MSA's instead of user accounts for services, IIS, scheduled tasks, SQL, etc.

Even if you have a cred vault that rotates and handles dependencies, MSA's are probably still better.

Read Steve's thread for how they work, then this one for how to use them.

https://twitter.com/SteveSyfuhs/status/1357419082413264902

First, a couple of things Steve didn't mention:

1) MSA passwords are incredibly strong and rotate frequently enough that Kerberoasting is near impossible (especially with AES)

2) The password can be retrieved on one server and used on another, pass the hash/ticket still works..

OK, first, let's find out if you have a KDS root key set up. Run Powershell on a machine with the Active Directory Powershell Module installed and run this:

Get-KDSRootKey

If you get nothing, then run this:

Add-KDSRootKey –EffectiveImmediately

Now wait 10 hours.. seriously :(

First, create a security group (DVWA-Servers), then create the gMSA in Powershell:

New-ADServiceAccount -Name DVWA-Svc -DNSHostName DVWA.domain​.com -PrincipalsAllowedToRetrieveManagedPassword DVWA-Servers -KerberosEncryptionType AES256

For MSA: Use -RestrictToSingleComputer

Next, on the server you want to use the MSA, run:

Test-ADServiceAccount DVWA-Svc

This should return "True"

Windows Services

You can grant "Log on as Service" permissions using secpol.msc, or Windows will do it for you when you add the gMSA to a service (leave password blank).

IIS

Open the IIS console, go to the Application Pool you want to use the gMSA on, and open Advanced Settings.

Scroll down to Identity and edit it to use a custom account. Specify your gMSA without a password and hit OK all the way out.

Grant folder permissions to the gMSA too

Scheduled Tasks

First, make sure you grant "Logon as batch" to the gMSA using secpol.msc.

Easy mode - create the task using the GUI and leave it as SYSTEM, then run cmd/PS as admin, and do this:

schtasks /change /TN \DVWA-Task /RU DOMAIN\DVWA-Svc$ /RP

Leave password blank

If you prefer Powershell :)

$principal = New-ScheduledTaskPrincipal -UserID DOMAIN\DVWA-Svc$ -LogonType Password

Set-ScheduledTask -TaskName DVWA-Task -Principal $principal

Now verify everything was updated in Task Scheduler and is working properly.

Don't forget permissions!

Running things as the MSA using PsExec is something I've never thought about.

Doing this allows you to "Get-Credential | Export-Clixml" a credential blob to disk for the MSA to use in scheduled tasks, or you could store certs for credential based auth.

https://twitter.com/SteveSyfuhs/status/1357436880174813185

gMSA's are a very secure way to do service accounts, but there are still areas you may need to secure further. Stealthbits covers this well here:

stealthbits.com/blog/securing-…

Also, consider using Authentication Policy Silos to limit where MSA's can be used.

https://twitter.com/NathanMcNulty/status/1357484228418490368