Delegated managed service accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 3892d2c · +3 −3 lines · also on GitHub
11
---
2
−title: Delegated Managed Service Accounts overview in Windows Server 2025
3
−description: Learn about delegated Managed Service Accounts (DMSA) that authenticate specific machine identities mapped in Active Directory along with Credential Guard (CG) to ensure device credentials isolation in Windows Server 2025.
2
+title: Delegated Managed Service Accounts overview in Windows Server 2025 (Preview)
3
+description: Learn about delegated Managed Service Accounts (DMSA) that authenticate specific machine identities mapped in Active Directory along with Credential Guard to ensure device credentials isolation in Windows Server 2025 (Preview).
44
ms.topic: conceptual
55
ms.author: alalve
66
author: mariamgewida
⋯ 11 unchanged lines
1818
1919
dMSAs and gMSAs are two types of managed service accounts that are used to run services and applications in Windows Server. A dMSA is managed by an administrator and is used to run a service or application on a specific server. A gMSA is managed by AD and is used to run a service or application on multiple servers. Both offer improved security and simplified password management. dMSA differs by:
2020
21
−- Utilizing gMSA concepts to limit scope of usage using [Credential Guard](/windows/security/identity-protection/credential-guard) (CG) to bind machine authentication.
21
+- Utilizing gMSA concepts to limit scope of usage using [Credential Guard](/windows/security/identity-protection/credential-guard) to bind machine authentication.
2222
- CG can be used to enhance security in dMSA by automatically rotating passwords and binding all service account tickets. Legacy accounts are then disabled to further improve security.
2323
- Although gMSAs are secured with machine generate and autorotated passwords, the passwords are still not machine bound and can be stolen.
2424
⋯ 81 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:22 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.