How to use Managed Service Accounts with vCenter Server - Logo

Many of the IT environments have so called security driven approach. Every time I hear that something has to be implemented it is because security said so. Don’t get me wrong – by all means I like to be secure and compliant. In my opinion there should be balance between Security and Costs.

I have found very nice chart which shows that.

Security estimation

In Today post I will show you how to configure vCenter Server to work with MSA.

Managed Service Account and Group Managed Service Account – what is that?

Managed Service Account was introduced by Microsoft with release of Windows Server 2008 R2.The best description is from Microsoft Technet Article.

The managed service account is designed to provide crucial applications such as IIS with the isolation of their own domain accounts, while eliminating the need for an administrator to manually administer the service principal name (SPN) and credentials for these accounts. It is a managed domain accounts that provides automatic password management and simplified SPN management. Virtual accounts are “managed local accounts” that can use a computer’s credentials to access network resources.

Group Managed Service Accounts was released with Windows Server 2012.

The group Managed Service Account provides the same functionality within the domain but also extends that functionality over multiple servers.

Unfortunately MSA was not ideal solution to most user problems due to limitations. With release of gMSA many more use cases might be found to use them. See table below with supported applications with MSA and gMSA supported applications.

Managed Service AccountsGroup Managed Service Accounts
Microsoft ExchangeSupportedSupported
Microsoft IISSupportedSupported
Microsoft SQL ServerNot SupportedSupported
Task SchedulerNot SupportedSupported

Which MSA should I use then some of you might ask. That depends how will you plan your environment. If you want to use same MSA account on several computers than you should use gMSA. If you will use MSA account on one server than you should use MSA.

Managed Service Account and Group Managed Service Account- prerequisites

Managed Service Accounts require the Active Directory schema to be updated to the Server 2008 R2 version.

Group Managed Service Accounts require the Active Directory schema to be updated to the Server 2012 version.

In my test lab I will show you how to run vCenter Server services and Microsoft SQL Server using Managed Service Accounts.

Managed Service Account creation

  1. Open PowerShell and import module Active Directory.
  2. To create a standalone managed service account which is linked to a specific computer, we will use the -RestrictToSingleComputer parameter in New-AdServiceAccount command.
  3. In the next step we will associate newly created MSA account to computer.
  4. On the target computer where we will install MSA open PowerShell, install Active Directory module (if it is not installed previously).
  5. Import Active Directory module (see first step) and install MSA account.
  6. Last step is to change log on account. Remember to clear password and Confirm password fields.
  7. Newly added account to service will be granted Log On As A Service right.

VMware vCenter Server Services

Below you can find all vCenter Server services. In third column you can see MSA account names.

Service Display NameService NameMSA account name
VMware afd ServiceVMWareAfdServicevmvafd
VMware Certificate ServiceVMWareCertificateServicevmcertservice
VMware Component ManagerVMwareComponentManagervmcomponentmgr
VMware Content Library Servicevdcsvmcontentlibr
VMware Directory ServiceVMwareDirectoryServicevmdirservice
VMware ESX Agent ManagerEsxAgentManagervmesxmanager
VMware HTTP Reverse Proxyrhttpproxyvmrhttproxy
VMware Identity Management ServiceVMwareIdentityMgmtServicevmidentservice
VMware Inventory Serviceinvsvcvminvservice
VMware License Servicevmware-licensevmlicservice
VMware Message Bus Config Servicembcsvmmbcs
VMware Performance Chartsvmware-perfchartsvmperfchar
VMware Security Token ServiceVMwareSTSvmsts
VMware Service Control AgentVMwareServiceControlAgentvmsvcctrlag
VMware Syslog CollectorvmSyslogCollectorvmsyslogcoll
VMware System and Hardware Health Managervmwarevwsvmhwmanager
VMware USB Arbitration ServiceVMUSBArbServicevmusbarbit
VMware vAPI EndpointvapiEndpointvmvapiend
VMware vCenter Configuration Servicevmware-cis-configvmcisconfig
VMware vCenter workflow managervmware-vpx-workflowvmvpxworkflow
VMware VirtualCenter Servervpxdvmvpxd
VMware vService ManagerVServiceManagervmvservicemng
VMware vSphere Auto Deploy Waitervmware-autodeploy-waitervmadwaiter
VMware vSphere ESXi Dump Collectorvmware-network-coredumpvmdumpcoll
VMware vSphere ESXi Dump Collector WebServiceVMWareNetworkCoredumpWebservervmdumpcollweb
VMware vSphere Profile-Driven Storage ServicevimPBSMvmpdss
VMware vSphere Web Clientvspherewebclientsvcvmwebclient

The next step is to import all MSA accounts to target computer. I simply added accounts using Computer Management.

How to use Managed Service Accounts with vCenter Server - 3

Once we have all accounts added to local Administrators groups we will stop all vCenter Services and replace user accounts associated to each service.

How to use Managed Service Accounts with vCenter Server - 4

I had to add WOJCIEH\vminvservice$, WOJCIEH\vmvpxd$ account as security login to vCenter Server and MSDB databases. This is needed to start vCenter Server service. If you will not do it you will see errors like this.

How to use Managed Service Accounts with vCenter Server - 5

After all changes and some tweaking we have fully functional vCenter Server running with MSA accounts.

How to use Managed Service Accounts with vCenter Server - 6

Virtual Accounts

However with vCenter Server 6.0 new concept of virtual accounts was introduced. Following VMware KB explains this concept: Use of virtual accounts for services on a Windows vCenter Server 6.0 (2124709) .From VMware KB we see that following services are used as virtual accounts.

ServiceService Account
VMware Component ManagerNT SERVICE\VMwareComponentManager
VMware Content Library ServiceNT SERVICE\vdcs
VMware ESX Agent ManagerNT SERVICE\EsxAgentManager
VMware Message Bus Config ServiceNT SERVICE\mbcs
VMware Performance ChartsNT SERVICE\vmware-perfcharts
VMware PostgresNT SERVICE\vPostgres
VMware vAPI EndpointNT SERVICE\vapiEndpoint
VMware vCenter workflow managerNT SERVICE\vmware-vpx-workflow
vmware vService ManagerNT SERVICE\VServiceManager
VMware vSphere Audo Deploy WaiterNT SERVICE\vmware-autodeploy-waiter
VMware vSphere Web ClientNT SERVICE\vspherewebclientsvc

As VMware guru you have to consider all cons and pros of each solution and decide to go with MSA accounts or not.

Summary

It took me a while to check prepare this post but I am happy that I could prove that MSA accounts are working as well with vCenter Server. What is unknown if VMware Support will help you if you are using MSA accounts. If you wish I can check as well if Group Managed Accounts are working with vCenter Server 6.0.

Rate this post
Wojciech Marusiak
Social Media

Wojciech Marusiak

Consultant at VMware Global, Inc.
I am innovative and experienced VMware and Windows Server Engineer with over 10 years in the IT industry specializing in VMware virtualization and Microsoft Server environment.

My experience and skills has been proven by leading vendor certifications like VMware Certified Advanced Professional 5 – Data Center Administration, VMware Certified Advanced Professional 5 – Data Center Design, VMware Certified Professional 6 - Data Center Virtualization, VMware Certified Professional 6 - Network Virtualization, Microsoft MCITP Server Administrator, ITIL V3, VMware vExpert 2014, 2015, 2016 and 2017 Award.

My blog wojcieh.net - was voted #50 in TopvBlog 2016 contest!
Wojciech Marusiak
Social Media