Delegated managed service accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 979e936 · +2 −2 lines · also on GitHub
⋯ 75 unchanged lines
7676
- The service account is removed from _Generic Read_ to all properties on the dMSA
7777
- The service account is removed from _Write_ property on the **msDS-GroupMSAMembership** attribute
7878
- **msDS-DelegatedMSAState** is set to 2
79
−- The Service Principal Names (SPN) are copied over from the service account to the dMSA account
79
+- The Service Principal Names (SPNs) are copied over from the service account to the dMSA account
8080
- **msDS-AllowedToDelegateTo** is copied over if applicable
8181
- **msDS-AllowedToActOnBehalfOfOtherIdentity** the security descriptor is copied over if applicable
8282
- The assigned AuthN policy, **msDS-AssignedAuthnPolicy**, of the service account are copied over
⋯ 1 unchanged line
8484
- The trusted "Auth for Delegation" User Account Control (UAC) bit is copied over if it was set on the service account
8585
- **msDS-SupersededServiceAccountState** is set to 2
8686
- The service account is disabled via the UAC disable bit
87
−- The SPN are removed from the account
87
+- The SPNs are removed from the account
8888
8989
## See also
9090
⋯ 1 unchanged line
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:22 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.