Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Topik ini menunjukkan cara membuat Akun Layanan Terkelola grup (gMSA) di
Layanan Terkelola untuk Microsoft Active Directory. Anda harus mengikuti
petunjuk standar ini
untuk menyiapkan akun dan menyertakan pertimbangan khusus berikut
untuk Managed Microsoft AD.
Jangan membuat kunci root KDS
Biasanya, saat pertama kali membuat gMSA di domain, Anda perlu membuat
kunci root Key Distribution Service (KDS). Microsoft AD Terkelola membuat kunci root
KDS untuk Anda saat membuat domain, sehingga Anda dapat melewati langkah tersebut dari
petunjuk standar.
Untuk melihat kunci root KDS, selesaikan langkah-langkah berikut:
Di Windows, luncurkan alat Situs dan Layanan Active Directory. Untuk meluncurkan
alat ini, Anda dapat membuka kotak dialog perintah Run, lalu memasukkan
dssite.msc.
Di alat Active Directory Sites and Services, pilih tab View.
Di menu View, pilih Show Services Node.
Di panel kiri, pilih Layanan > Layanan Distribusi Kunci Grup > Kunci Root Utama.
Panel kanan menampilkan daftar kunci untuk domain Anda. Pilih kunci untuk melihat detailnya.
Perhatikan bahwa menjalankan cmdlet PowerShell Get-KdsRootKey akan menampilkan respons kosong walaupun kunci root KDS yang valid ada. Anda hanya dapat melihat kunci saat
menjalankan cmdlet Get-KdsRootKey sebagai Admin Domain.
Membuat akun dalam penampung Managed Service Accounts
Untuk domain Managed Microsoft AD, gMSA baru harus dibuat
di bawah penampung Managed Service Accounts. Secara default,
cmdlet New-ADServiceAccount membuat gMSA baru di lokasi ini. Untuk mengetahui informasi selengkapnya, lihat
cmdlet New-ADServiceAccount.
Mendelegasikan administrasi Managed Service Accounts
Anda dapat mendelegasikan administrasi penampung Managed Service Accounts kepada pengguna dengan
menambahkannya ke grup Cloud Service Managed Service Account Administrators.
Untuk informasi selengkapnya tentang grup yang dibuat Managed Microsoft AD untuk Anda, lihat Grup.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-11 UTC."],[],[],null,["# Create a group Managed Service Account\n\nThis topic shows you how to create a group Managed Service Account (gMSA) in\nManaged Service for Microsoft Active Directory. You should follow\n[these standard instructions](https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts#create-a-group-managed-service-account)\nfor setting up the account and incorporate the following special considerations\nfor Managed Microsoft AD.\n\nDo not create KDS root key\n--------------------------\n\nUsually, the first time you create a gMSA in a domain, you need to generate a\nKey Distribution Service (KDS) root key. Managed Microsoft AD generates a KDS\nroot key for you when you create the domain, so you can skip that step from\n[the standard instructions](https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts#create-a-group-managed-service-account).\n\n### View the KDS root key\n\nBefore you begin, be sure that the Active Directory Sites and Services tool is\ninstalled from\n[Remote Server Administration Tools (RSAT)](https://support.microsoft.com/en-us/help/2693643/remote-server-administration-tools-rsat-for-windows-operating-systems).\n\nTo view the KDS root key, complete the following steps:\n\n1. In Windows, launch the Active Directory Sites and Services tool. To launch this tool, you can open the **Run** command dialog box, and then enter `dssite.msc`.\n2. In the **Active Directory Sites and Services** tool, select the **View** tab.\n3. In the **View** menu, select **Show Services Node**.\n4. In the left pane, select **Services \\\u003e Group Key Distribution Service \\\u003e Master\n Root Keys**.\n5. The right pane shows a list of keys for your domain. Select a key to view its details.\n\nNote that running the `Get-KdsRootKey` PowerShell cmdlet returns an empty\nresponse even though a valid KDS root key exists. You can only see the key when\nyou run the `Get-KdsRootKey` cmdlet as the Domain Admin.\n\nCreate account under `Managed Service Accounts` container\n---------------------------------------------------------\n\nFor a Managed Microsoft AD domain, new gMSAs should be created\nunder the `Managed Service Accounts` container. By default,\nthe `New-ADServiceAccount` cmdlet creates new gMSAs in this location. For more information, see\n[`New-ADServiceAccount`cmdlet](https://learn.microsoft.com/en-us/powershell/module/activedirectory/new-adserviceaccount?view=windowsserver2022-ps).\n\nDelegate administration of `Managed Service Accounts`\n-----------------------------------------------------\n\nYou can delegate the administration of the `Managed Service Accounts` container to a user by\nadding them to `Cloud Service Managed Service Account Administrators` group.\nFor more information about the groups that Managed Microsoft AD creates for you, see [Groups](/managed-microsoft-ad/docs/objects#groups)."]]
