Question
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two servers named Server1 and Server2 that run Windows Server 2022.
You plan to deploy an app named App1 that will be load balanced between Server1 and Server2.
You need to create an identity that will be used to run App1 on Server1 and Server2. The solution must meet the following requirements:
• The password for the identity must be changed regularly.
• Administrative effort must be minimized.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Explanation
1. Create a Key Distribution Services (KDS) root key (Add-KdsRootKey). Domain controllers use the KDS root key to generate gMSA passwords, so it must exist before you can create a gMSA.
2. Create a group managed service account (gMSA) (New-ADServiceAccount) and allow Server1 and Server2 to retrieve its password. A gMSA can be used on several servers at once, which suits App1's load-balanced deployment. AD changes its password automatically, so it is changed regularly with no administrative effort.
3. Install the service account on Server1 and Server2 (Install-ADServiceAccount), then configure App1 to run as it.
An sMSA can be used on only one computer, so it cannot serve both load-balanced servers. Creating an SPN or enabling constrained delegation does not create the identity or manage its password.
