{"id":3906,"date":"2021-10-25T08:00:00","date_gmt":"2021-10-25T05:00:00","guid":{"rendered":"https:\/\/www.dataplatform.gr\/?p=3906"},"modified":"2022-07-18T00:23:31","modified_gmt":"2022-07-17T21:23:31","slug":"pos-ftiachnoyme-ena-group-managed-service-sto-active-directory-gia-na-s","status":"publish","type":"post","link":"https:\/\/www.dataplatform.gr\/en\/pos-ftiachnoyme-ena-group-managed-service-sto-active-directory-gia-na-s\/","title":{"rendered":"How do we create a Group Managed Service in Active Directory to pick up the SQL Server service without using a password"},"content":{"rendered":"

To SQL Server<\/strong> we have to change the user that "raises" the SQL Server service from the Windows default to someone with specific rights that belongs to the Active Directory Domain. In this article we will see how we can create one Group Managed Service<\/strong> which will allow us to control these accounts en masse and not have the need to use a password for each one. <\/p>\n\n\n\n

The installation<\/h2>\n\n\n\n

The actions required on the Active Directory Domain Controller<\/h4>\n\n\n\n

To create the Security Group we connect to the server that has the Active Directory Controller, go to Active Directory Users and Computers<\/strong><\/em>, right click on domain<\/em><\/strong>, New<\/em><\/strong>, Group<\/strong><\/em>:<\/p>\n\n\n\n

\"\"
01<\/figcaption><\/figure>\n\n\n\n

We assign a name to the Group:<\/p>\n\n\n\n

\"\"
02<\/figcaption><\/figure>\n\n\n\n

Then we choose right click on the Group we made, Members<\/em><\/strong>, Add\u2026<\/strong><\/em>, as object type we define Computers, as location the Domain, the names of the servers that the managed services will use and finally we choose Check Names<\/em><\/strong>:<\/p>\n\n\n\n

\"\"
03<\/figcaption><\/figure>\n\n\n\n

Next we need to make a key for the distribution service (KDS). We will be able to use this key after 10 hours. For the key to be created and to be effective immediately, run the following command at PowerShell<\/strong>:<\/p>\n\n\n\n

Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10))<\/pre>\n\n\n\n
To see that it was created normally, run the following:<\/p>\n\n\n\n
Get-KdsRootKey<\/pre>\n\n\n\n
AttributeOfWrongFormat :\nKeyValue               : {197, 92, 95, 225...}\nEffectiveTime          : 5\/10\/2021 4:03:28 \u03c0\u03bc\nCreationTime           : 5\/10\/2021 2:03:28 \u03bc\u03bc\nIsFormatValid          : True\nDomainController       : CN=WS3,OU=Domain Controllers,DC=dataplatform,DC=local\nServerConfiguration    : Microsoft.KeyDistributionService.Cmdlets.KdsServerConfiguration\nKeyId                  : beffa3be-d2e1-989b-d545-03706e73906e\nVersionNumber          : 1<\/code><\/pre>\n\n\n\n
To create the Group Managed Service<\/em> run the following command setting:<\/p>\n\n\n\n