Question
Your network contains a single-domain Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the servers shown in the following exhibit table.
| Name | Description |
|---|---|
| DC1 | Domain controller |
| Server1 | Member server |
You plan to install a line-of-business (LOB) application on Server1. The application will install a custom Windows service.
A new corporate security policy states that all custom Windows services must run under the context of a group managed service account (gMSA). You deploy a root key.
You need to create, configure, and install the gMSA that will be used by the new application.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point
- A. On Server1, run the setspn command.
- B. On DC1, run the New-ADServiceAccount cmdlet. Correct
- C. On Server1, run the Install-ADServiceAccount cmdlet. Correct
- D. On Server1, run the Get-ADServiceAccount cmdlet.
- E. On DC1, run the Set-ADComputer cmdlet.
- F. On DC1, run the Install-ADServiceAccount cmdlet.
Explanation
To create a group managed service account (gMSA), the New-ADServiceAccount cmdlet must be run on DC1. To install and configure this gMSA on Server1 where the LOB application will reside, the Install-ADServiceAccount cmdlet should be executed.
