Managed Service Accounts Windows Server 2016. This is first introduced with windows server 2012. I can create the msa on the domain controller with no issue:
Using msa, you can considerably reduce the risk of system accounts running system services being compromised. Managed group service accounts are stored in the managed service account container of the active directory. Best practices for installing, configuring, and maintaining sharepoint server 2016” it is stated “this book will use a minimal service accounts to maintain the best possible performance by creating the least number of application pools in sharepoint.”
This is first introduced with windows server 2012.
Managed service accounts are managed accounts in a domain that provide automatic password management and simplified management of the participant service names including delegating control to other administrators. Standalone managed service accounts, introduced a long ago with windows server 2008 r2, were a ray of hope for the database administrators. Group managed service accounts (gmsas), introduced in windows server 2012, provide the same functionality within the domain but also extend that functionality over multiple servers. The lap includes two windows server 2016 machines.