Return
-
Title
STS gMSA account fails to start -
Description
Following an initial unsuccessful attempt to replace standard service accounts using gMSA service accounts, we were able to modify the account on the PasswordManager service and restart without issue. However, when performing the same operation on the "STS" service, SQL error (1064) appeared upon restarting the service.
Does Password Manager support gMSA?
-
Resolution
Password Manager cannot be installed using Managed Service Accounts (gMSA's). The option to choose a gMSA is not available during installation. Post installation the service account and the application pool identity accounts can be changed to a gMSA if required, but an ordinary account with the appropriate privileges will be needed to logon to the PMAdmin site.Also, a gMSA cannot be used as a Domain Management account. This will have to be an ordinary account with the appropriate permissions granted.STS can be run under a gMSA account context. The STS SQL error (1064) means that STS has no access to the Password Manager configuration because the user has changed.Workaround:Reconfigure STS following below steps:1.- Stop PM Secure Token Server service2.- Go to the Password Manager installation folder/Service/SecureTokenServer and delete rstsConfig.bin. There should be a rstsConfig.bin.backup, copy this file and rename the copied file to simply rstsConfig.bin3.- Start PM Secure Token Server service4.- Go to General Settings/Secure Token Server on the PMAdmin site. If you are prompted to introduce a password, type admin5.- Reconfigure STSNote that the provider for AD might need to be modified with a valid domain management account which has read permissions.