Group Managed Service Accounts Limitations. These new type of accounts enjoy the same password management benefits as msa’s, while overcoming the limitations of msas. Virtual accounts, as discussed in part one, are local computer accounts which must use the domain computer account if they need to reach out and access network resources.
Gmsa satisfying all the limitations with msa. Group managed service accounts are most beneficial when you must operate different services under the same service account, for example in a nlb or cluster environment. These new type of accounts enjoy the same password management benefits as msa’s, while overcoming the limitations of msas.
Group managed service accounts got following capabilities, • no password management • supports to share across multiple hosts • can use to run schedule tasks (managed service accounts do not support to run schedule tasks) • it is uses microsoft key distribution service (kdc) to create and manage the passwords for the gmsa.
Group managed service accounts are created via the active directory powershell module as there is no facility to do this in the active directory users and computers admin tool. How to use group managed service accounts (gmsa) vs. A gmsa can be used for scheduled tasks. Group managed service accounts provides the same functionalities as managed service accounts but its extend its capabilities to host group levels.