AD Pro Toolkit Standalone Managed Service Account (sMSA) Setup

A standalone managed service account (sMSA) is an Active Directory account whose password Windows manages, so there is no password to type, store or rotate. The AD Pro Toolkit service runs as this account and connects to Active Directory as itself.

AD Pro Toolkit doesn't create the managed service account, so create it before you run the setup wizard.

Set up the account

Replace ADProToolkitSvc with the name you want, and HOSTNAME with the name of the computer AD Pro Toolkit is installed on.

1. Create the account. In PowerShell, on a computer with the Active Directory PowerShell module:

   New-ADServiceAccount -Name "ADProToolkitSvc" -RestrictToSingleComputer
   

2. Allow the AD Pro Toolkit computer to use it:

   Add-ADComputerServiceAccount -Identity "HOSTNAME" -ServiceAccount "ADProToolkitSvc"
   

3. On the AD Pro Toolkit computer, install the account:

   Install-ADServiceAccount -Identity "ADProToolkitSvc"
   

4. On the same computer, test it. It should return True:

   Test-ADServiceAccount -Identity "ADProToolkitSvc"
   

5. Grant the account the permissions it needs. See Permissions in the install guide.

Use it in the setup wizard

Run the setup wizard. On Step 1 of 4, choose Managed service account and enter the account, for example CONTOSO\ADProToolkitSvc. On step 2 there is no username or password to enter; the account connects as itself.