Skip to main content

Configure Managed Service Account for Active Directory

Microsoft Active Directory guide

Run NIM with a managed service account (MSA) to grant only the permissions it needs—without using a highly privileged interactive account.

Before you begin​

Run these commands in an elevated PowerShell session on the NIM server.

Choose an account name and identify the NIM server that will use it.

Plan the Active Directory organizational units that NIM needs to manage.

Create and install the service account​

1. Create the managed service account​

New-ADServiceAccount -Name <NAMEOFACCOUNT> -RestrictToSingleComputer
tip

By default, the MSA is created in CN=Managed Service Accounts. Use the -Path parameter to select a different organizational unit. -RestrictToSingleComputer limits the account to one server.

Replace <NIMSERVERNAMEHERE> with the name of the NIM server and <NAMEOFACCOUNT> with the MSA you created.

$TargetServer = Get-ADComputer -Identity <NIMSERVERNAMEHERE>
Add-ADComputerServiceAccount -Identity $TargetServer -ServiceAccount <NAMEOFACCOUNT>

3. Verify and install the account​

Get-ADServiceAccount <NAMEOFACCOUNT>
Install-ADServiceAccount -Identity <NAMEOFACCOUNT>
Test-ADServiceAccount <NAMEOFACCOUNT>

Test-ADServiceAccount should return True. After installation, follow the Configure connection guide to assign the account to the NIM Windows service.

Delegate Active Directory permissions​

Use least privilegeDelegate permissions only to the organizational units and object types that NIM manages.
  1. Create an Active Directory group for the MSA and add the MSA as a member.
  2. In Active Directory Users and Computers, right-click the domain root or the relevant organizational unit, then select Delegate Control.
  3. Add the group you created and delegate the tasks NIM requires. Common permissions include:
    • Create, delete, and manage user accounts
    • Reset user passwords and force password change at next sign-in
    • Read all user information
    • Modify group membership
  4. On the NIM server, grant that group Full control to:
    • C:\ProgramData\Tools4ever\NIM
    • C:\Program Files\Tools4ever\NIM\sysconfig