0

I have a question on implementing gMSA account for managing authentication to SQL server.

Our goal is to use gMSA account to manage the auto password change activities for SQl server service and it's agent service.

Few questions-

  1. Does implementing gMSA works for 2 node SQL FCI and 3 or 4 Node Always on AG,s?

  2. Since I just want to run SQl server with that gMSA account is there any special permissions needs to be granted at server or database level while running both SQL and agent services?

Our AD team gets all the background work related to creation of those accounts. Once ready we are just handed over the abc$ account e.g. to use them for running SQL services without entering the need of any password.

Please advise any catch of implementing gMSa here.

2

Does implementing gMSA works for 2 node SQL FCI and 3 or 4 Node Always on AG,s?

Yes it does work.

Since I just want to run SQl server with that gMSA account is there any special permissions needs to be granted at server or database level while running both SQL and agent services?

Nope, the installer will take care of that.

Please advise any catch of implementing gMSa here.

If certain windows services don't start before SQL Server, then authentication can't take place and SQL Server will fail to start up. This doesn't happen very often and generally when it does there is some other issue with the server that is causing this symptom and behavior.

  • thanks for your inputs. I just implemented on one of the server and seems some SQL agent jobs started failing due to permission issues, As you said installer will take care of that, is this failure something strange? Do we need to have something else checked in gMSA here? – BeginnerDBA Aug 16 at 14:30
  • @BeginnerDBA The installer takes care of the core permissions. If you have agent jobs that touch outside of the engine then you still need to manually give those permissions. – Sean Gallardy Aug 16 at 19:06
  • for my test servers with mirroring and Log shipping configured. It seems after implementing gMSA on the mirror side first it seems to have disconnected the mirroring and LS. Are there any checks ? – BeginnerDBA Aug 26 at 14:51
  • 1
    @BeginnerDBA Did you give the account permissions on the endpoint? Did you give that account permissions to the folders? The setup will take care of whatever SQL server needs to start up and run. Anything outside of that, as I mentioned, will need to expressly granted by you. – Sean Gallardy Sep 1 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.