Security – Using a Group Managed Service Account (gMSA) for a scheduled task

Securityservice-accountswindows-server-2012

Back in Windows Server 2008 R2, when stand-alone Managed Service Accounts (sMSA) were new, they could not be used to execute scheduled tasks. In Windows Server 2012 however, there is a new type of account called the Group Managed Service Account (gMSA). This type of account is supposedly capable of launching scheduled tasks in the task scheduler on clients & member servers inside of a Windows Server 2012 forest/domain functional level.

So far, I have:

  • Established a Windows Server 2012 forest/domain
  • Created a Group Managed Service Account (gMSA)
  • Installed the gMSA on a Windows Server 2012 member server

And currently I'm having trouble with:

  • Setting a scheduled task to use the gMSA

When I attempt to use a gMSA on a scheduled task, I get the error message that says "The object cannot be found" (paraphrased) message.

My question is: How do I configure a Scheduled Task to execute using a Group Managed Service Account (gMSA)?

Best Answer

The answer has been blogged here: http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx

Blog now archived here: https://web.archive.org/web/20130627015803/http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx

The short version is to use the Register-ScheduledTask PowerShell cmdlet combined with New-ScheduledTaskPrincipal -LogonType Password -UserID YourDomain\YourgMSA$.

Related Topic