Part 3 – Configure the SQL Server instance to use the gMSA

After you have installed the Active Directory SQL service account on the server, you will need to configure SQL Server to use the new service account. Launch SQL Server configuration manager, and enter the service account appended with a “$” or search for it using the browse button. Once you have entered/selected the account, click “OK” and the password will be automatically filled in for you.

Part 3 use svc account

Part 3 use svc account 2

Since we gave the service account permissions to manage SPN’s, open the SQL Server log and verify that SQL Server is able to register an SPN.

Part 3svc account register sql SPN

We can now go to another server and verify that we can connect with TCP and the authentication protocol is Kerberos.

Part 3 verify kerberos

Now we can to make sure the computer can read the gMSA password after the server is rebooted. We ensure that SQL Server can read the gMSA password by creating a dependency on the Netlogon and Windows Time services. For detailed explanation about these dependencies, please this blog post by Wayne Sheffield.  Open a command prompt with administrator privileges and run the command below.


sc config MSSQLSERVER depend= NetLogon/W32Time

Verify that the dependecies have been created by looking at the SQL Server service properties in the service control manager snap-in.

Service Dependency

Congratulations you have complete the tutorial SQL Server & Group Manged Service Accounts (gMSAs).

Back to Main Page