Delegated managed service accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 9777819 · +4 −4 lines · also on GitHub
11
---
2
−title: Delegated Managed Service Accounts overview in Windows Server Insider Preview
3
−description: Learn about delegated Managed Service Accounts (DMSA) that authenticate specific machine identities mapped in Active Directory (AD) along with Credential Guard (CG) to ensure device credentials isolation in Windows Server Insiders Preview.
2
+title: Delegated Managed Service Accounts overview in Windows Server 2025 (Preview)
3
+description: Learn about delegated Managed Service Accounts (DMSA) that authenticate specific machine identities mapped in Active Directory (AD) along with Credential Guard (CG) to ensure device credentials isolation in Windows Server 2025 (Preview).
44
ms.topic: conceptual
55
ms.author: alalve
66
author: mariamgewida
⋯ 3 unchanged lines
1010
# Delegated Managed Service Accounts overview
1111
1212
> [!IMPORTANT]
13
−> Windows Server Insider builds are in PREVIEW. This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
13
+> Windows Server 2025 is in Preview. This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
1414
15
−A new account type known as delegated Managed Service Account (dMSA) is introduced in Windows Server Insiders Preview that allows migration from a traditional service account to a machine account with managed and fully randomized keys, while disabling original service account passwords. Authentication for dMSA is linked to the device identity, which means that only specified machine identities mapped in AD can access the account. Using dMSA helps to prevent harvesting credentials using a compromised account (kerberoasting), which is a common issue with traditional service accounts.
15
+A new account type known as delegated Managed Service Account (dMSA) is introduced in Windows Server 2025 (Preview) that allows migration from a traditional service account to a machine account with managed and fully randomized keys, while disabling original service account passwords. Authentication for dMSA is linked to the device identity, which means that only specified machine identities mapped in AD can access the account. Using dMSA helps to prevent harvesting credentials using a compromised account (kerberoasting), which is a common issue with traditional service accounts.
1616
1717
## dMSA and gMSA comparison
1818
⋯ 73 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:22 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.