Set Windows Service Login to a GMSA Account

user_12121402 0
Viewed 1887

I have a service that gets created by a third party vendor that every time an instance of this software gets installed I have to manually go in and change the login account to a GMSA account.

By default this service is created with the logon account as local system. When I run the below Powershell code I get a return value of 21 where there is an invalid parameter:

'''

$ServiceObject  = get-wmiobject -Class Win32_Service -filter "Name='$ServiceName'"
$ServiceObject.StopService() | out-null

# Change logon as settings
$ServiceObject.Change($null,$null,$null,$null,$null,$null,$GMSAServiceAccount,$null,$null,$null,$null) 
$ServiceObject.StartService()

'''

I did find in my testing if I manually made the Service Account logon as a different user on the same domain as the GMSA. Then run the above script it runs successfully. Is there another step I'm missing?

powershell-3.0 powershell
1 Answers

We use this piece of code to configure gMSA accounts with services:

$serviceName = 'myService' 
$ServiceObject = Get-WmiObject -Class Win32_Service -Filter "Name='$serviceName'" 
$ServiceObject.StopService() | out-null

# Change logon as settings
$ServiceObject.Change($null, $null, $null, $null, $null, $null, "$env:USERDOMAIN\$gMSA_Name$", $null, $null, $null, $null)
$ServiceObject.StartService()

Make sure that there is an $ behind the gMSA account name. This indicates it is a gMSA account.

user_91726950
Related