The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For an on-premises Windows service, use a group managed service account (gMSA) when the application supports it; use a standalone managed service account (sMSA) when the service runs on one computer and does not support a gMSA. A “network service account” is not one specific Windows account type. The right identity depends on which computers run the service, what the application supports, and which resources it must access.
What a Windows service account does
A service account is the identity a Windows service uses to access local and network resources. It is more than a password stored for an application: its permissions determine what the service can do, and its logons can be audited. Microsoft describes several options, including traditional domain accounts, managed service accounts, delegated managed service accounts, and virtual accounts. Microsoft’s service-account overview explains the distinctions.
Which account type should you choose?
| Account type | Best fit | Important boundary |
|---|---|---|
| Traditional domain user account | Compatibility fallback when the service does not support a managed service account. | An administrator manages its credentials. Apply domain password policy and plan careful password rotation. Microsoft’s selection guidance recommends managed accounts where supported. |
| Standalone managed service account (sMSA) | A supported service running on one server. | It is associated with one computer and cannot be shared across multiple computers. Microsoft’s service-account overview and sMSA security guidance describe its scope. |
| Group managed service account (gMSA) | A supported service running on one or more servers, including server farms and some network load-balanced deployments. | Active Directory manages the password; authorize only the intended host computers. Do not assume every failover-cluster workload supports gMSAs. Microsoft’s gMSA overview covers farm and cluster considerations. |
| Delegated managed service account (dMSA) | Specific Windows Server 2025 scenarios involving machine-identity-linked authentication or migration from an eligible traditional account. | Support is version- and scenario-specific. Microsoft says a dMSA cannot be migrated from an MSA or gMSA; verify that the particular workload and migration path are supported. See the dMSA overview. |
| Virtual account | A local service identity that needs to access network resources using the computer’s identity. | Network access uses the computer account credentials; a virtual account is not a shared identity for multiple hosts. See Microsoft’s overview. |
Before choosing, check how many computers will run the service, whether the software supports a managed identity, whether clients or other systems expect a particular service principal, and what your Windows Server and domain environment support. For on-premises services, Microsoft recommends a gMSA when possible and an sMSA when a gMSA is unsupported. Keep each service’s identity separate where that improves security and auditability.
Free tools Windows power users keep installed
One-click scans. No signup required.
What to verify before creating a gMSA
Creating a gMSA requires Active Directory Domain Services (AD DS), the necessary administrative authorization, suitable domain and forest functional levels, and a Key Distribution Services (KDS) root key in the domain. Microsoft’s documented management procedure specifies Domain Admins or Enterprise Admins membership, Windows Server 2012 or later domain and forest functional levels for broad support, and a KDS root key. Confirm that these requirements match your environment and policy in Microsoft’s gMSA management guide.
#1 Best Overall
- 3.5 Inch Hot Plug Hard Drive PowerEdge T340 Tower Server Chassis
- Microsoft Windows Server 2019 Standard Operating System
- Processors: Intel Xeon E-2124 Quad-Core 3.3GHz 8MB CPU, Up To 4.3GHz Turbo
- Memory: 32GB (2 x 16GB) DDR4 PC4-21300 2666MHz Unbuffered Memory
- Hard Drive: 8TB (4 x 2TB) 7.2K RPM 6Gb/s SATA 3.5 Inch HDDs in RAID
Microsoft documents the Active Directory PowerShell module and cmdlets such as New-ADServiceAccount, Install-ADServiceAccount, and Get-ADServiceAccount. Their availability and the permissions needed to run them depend on your management host and domain configuration. Use Microsoft’s guide for the procedure that fits your environment rather than assuming a single command sequence applies to every service.
How to create and deploy a gMSA safely
- Confirm the workload. Check the application’s documentation for managed-account support, identify every computer that will run the service, and verify any service-principal or client-authentication requirements.
- Validate directory prerequisites. Confirm AD DS, domain and forest functional levels, KDS root-key status, and the required administrative authorization using the gMSA management guide.
- Create the gMSA and authorize its hosts. Use the documented Active Directory PowerShell workflow to create the account and specify which computer accounts may retrieve its managed password. Limit this set to the service’s actual hosts.
- Install and test the account on each host. Follow Microsoft’s procedure for the supported Windows Server and Active Directory module. Verify that each intended computer can use the account before changing production service configuration.
- Configure the service through its supported interface. Use the application or Windows service’s documented account-setting method. Configuration differs across services, application pools, scheduled tasks, and other workloads.
- Verify operation and access. Confirm that the service starts, performs its intended work, and can reach only the network resources it needs. Check logs and authentication behavior for failures.
- Review permissions after deployment. Remove unnecessary group memberships and resource permissions, then audit access to sensitive resources.
How to keep the service identity secure
Managed password rotation reduces manual credential handling, but it does not make an overprivileged account safe. Apply least privilege to the identity, its authorized hosts, and the resources it can reach. Microsoft’s gMSA management guidance and gMSA security guidance recommend reviewing group membership, removing unnecessary privileged memberships, granting only required rights, and auditing sensitive-resource access.
Rank #2
- Windows server license is not included
- Authorize only the computers that need to retrieve or use the gMSA credentials.
- Use separate service identities where that makes access easier to limit and audit.
- Do not add service accounts to privileged groups unless the workload has a documented, necessary requirement.
- Review and remove permissions the service no longer needs.
- Monitor account activity and investigate unexpected source or destination logons with the identity-security tools available in your environment. Microsoft describes service-account monitoring in Defender for Identity service account discovery.
Check cluster and managed-domain compatibility
gMSA support is not universal across failover-cluster deployments. Microsoft says failover clusters do not provide general gMSA support, while certain services operating on the Cluster service can use an sMSA or gMSA if they are a Windows service, application pool, scheduled task, or otherwise natively support a managed account. Verify the exact workload against Microsoft’s gMSA overview before deployment.
Recommended Free Tools
Do not assume that instructions for conventional AD DS apply unchanged to a managed domain. Microsoft maintains separate guidance for gMSAs in Microsoft Entra Domain Services; check that documentation if that is your directory environment.
Rank #3
- MODEL P74439-005: Compact and affordable HPE ProLiant MicroServer Gen11 powered by Intel Pentium Gold G7400 3.7GHz processor, ideal for file sharing, NAS, and basic business workloads
- READY OUT OF THE BOX: Includes 16GB DDR5 UDIMM memory (expandable to 128GB), one 1TB SATA 6G Business Critical HDD, embedded Intel VROC SATA, dedicated iLO-M.2 port kit, 180w external power adapter and 1/1/1 warranty for dependable plug-and-play server operation
- WHISPER-QUIET & SPACE-SAVING: Ultra-compact mini tower design fits easily in small office spaces; supports wall, flat, or vertical placement for deployment flexibility
- INTEGRATED REMOTE MANAGEMENT: Comes with HPE iLO 6 and embedded TPM 2.0 for secure, license-free remote server administration through shared port access
- EXPANDABLE DESIGN: Two PCIe slots (including PCIe 5.0) and four LFF-NHP drive bays provide robust options for storage and component scalability. Features new MR408i-p controller support for enhanced storage performance
When a traditional domain account is unavoidable
If the application cannot use an sMSA or gMSA, a traditional domain account can be a compatibility fallback. Treat it as a credential-management responsibility: apply the organization’s domain password policy, define a rotation process the application can tolerate, and grant only the rights the service needs. A manually managed password can make rotation and recovery more operationally involved than a managed account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Windows Server 2025 dMSA scenarios
A dMSA is a distinct option for supported Windows Server 2025 scenarios, including machine-identity-linked authentication and migration from an eligible traditional service account. It is not a general replacement for every service identity: Microsoft’s overview states that migration from an MSA or gMSA is not supported. Review the dMSA overview and setup instructions for the exact Windows Server 2025 scenario before planning a migration.
Quick Recap
Rank #4
- This Certified Refurbished product is tested and certified to look and work like new. The refurbishing process includes functionality testing, basic cleaning, inspection, and repackaging. The product ships with all relevant accessories, a minimum 90-day warranty, and may arrive in a generic box. Only select sellers who maintain a high-performance bar may offer Certified Refurbished products on Amazon.com.
- Dell Optiplex 3050 SFF Desktop computer PC, Intel Quad Core i5-6500 up to 3.6GHz, 16GB DDR4, 256GB SSD
- Includes: USB Keyboard & Mouse, USB WiFi adapter, Microsoft office 30 days free trail.
- Port: Front: USB 3.0(2), USB 2.0(2); Rear: DP, HDMI, USB 3.0(2), USB 2.0(2), RJ-45.
- Support 4K (3840x2160) Dual display, makes it easy to connect two monitors at the same time, and you can expand working Windows, mirror content, or expand a single window across multiple monitors.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
