Delegated managed service accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit df9a0d4 · +21 −5 lines · also on GitHub
11
---
2
−title: Delegated Managed Service Accounts overview in Windows Server 2025 (Preview)
3
−description: Learn about delegated Managed Service Accounts (DMSA) that authenticate specific machine identities mapped in Active Directory (AD) along with Credential Guard (CG) to ensure device credentials isolation in Windows Server 2025 (Preview).
2
+title: Delegated Managed Service Accounts overview in Windows Server 2025
3
+description: Learn about delegated Managed Service Accounts (DMSA) that authenticate specific machine identities mapped in Active Directory along with Credential Guard (CG) to ensure device credentials isolation in Windows Server 2025.
44
ms.topic: conceptual
55
ms.author: alalve
66
author: mariamgewida
7
−ms.date: 02/14/2024
7
+ms.date: 09/30/2024
88
---
99
1010
# Delegated Managed Service Accounts overview
⋯ 1 unchanged line
1212
> [!IMPORTANT]
1313
> Windows Server 2025 is in Preview. This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
1414
15
−A new account type known as delegated Managed Service Account (dMSA) is introduced in Windows Server 2025 that allows migration from a traditional service account to a machine account with managed and fully randomized keys, while disabling original service account passwords. Authentication for dMSA is linked to the device identity, which means that only specified machine identities mapped in AD can access the account. Using dMSA helps to prevent harvesting credentials using a compromised account (kerberoasting), which is a common issue with traditional service accounts.
15
+A new account type known as delegated Managed Service Account (dMSA) is introduced in Windows Server 2025 that allows migration from a traditional service account to a machine account with managed and fully randomized keys, while disabling original service account passwords. Authentication for dMSA is linked to the device identity, which means that only specified machine identities mapped in Active Directory (AD) can access the account. Using dMSA helps to prevent harvesting credentials using a compromised account (kerberoasting), which is a common issue with traditional service accounts.
1616
1717
## dMSA and gMSA comparison
1818
⋯ 5 unchanged lines
2424
2525
## Functionality of dMSA
2626
27
−dMSA allows users to create them as a standalone account, or to replace an existing standard service account. When a dMSA supersedes an existing account, authentication to that existing account using its password will be blocked. The request is redirected to the [Local Security Authority](/windows/win32/secauthn/lsa-authentication) (LSA) to authenticate using dMSA, which has access to everything the previous account could access in AD.
27
+dMSA allows users to create them as a standalone account, or to replace an existing standard service account. When a dMSA supersedes an existing account, authentication to that existing account using its password is blocked. The request is redirected to the [Local Security Authority](/windows/win32/secauthn/lsa-authentication) (LSA) to authenticate using dMSA, which has access to everything the previous account could access in AD.
2828
2929
During migration, dMSA automatically learns the devices on which the service account to be used which is then used to move from all existing service accounts.
3030
⋯ 54 unchanged lines
8585
- **msDS-SupersededServiceAccountState** is set to 2
8686
- The service account is disabled via the UAC disable bit
8787
- The SPNs are removed from the account
88
+
89
+## dMSA realms
90
+
91
+Realms serve as logical groupings that define authentication boundaries, commonly used when integrating different versions of AD across domains or forests. They're especially important in mixed domain environments where some domains may not fully support all features of dMSA. By specifying realms, dMSA can ensure proper communication and authentication flow between domains.
92
+
93
+Administrators can use realms to specify which domains or directory components can authenticate and access the dMSA account. This ensures that even older child domains, which may not natively support dMSA features, can interact with the accounts while maintaining security boundaries. By enabling a smoother transition and coexistence of features across mixed environments, realms help ensure compatibility without compromising security.
94
+
95
+For example, if you have a primary domain called `corp.contoso.com` running on Windows Server 2025 and an older child domain called `legacy.corp.contoso.com` running Windows Server 2022, you can specify the realm as `legacy.corp.contoso.com`.
96
+
97
+To edit this group policy setting for your environment, navigate to the following path:
98
+
99
+```group policy
100
+Computer Configuration\Administrative Templates\System\Kerberos\Enable Delegated Managed Service Account logons
101
+```
102
+
103
+
88104
89105
## See also
90106
⋯ 1 unchanged line
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:22 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.