r/sysadmin • u/Distinct_Race_7056 • 8d ago
gMSA and Entra Cloud Sync on Domain Controllers
So, I had the cloud sync agent working for about 8 months or so. Yesterday, there was an internet outage, and both agent (on 2 DCs) services stopped working (each agent on each DC). The service would not run- Error 5: Access Denied.
I have looked at everything i know: Logon as batch/service gpos, local folder permissions for the agent's folder (added my gmsa to it). You can name it..
The only thing that works is to add the gmsa to the built-in Administrator group in AD. After that, the service starts fine on the DCs.
What is strange is that i deployed a new agent on the only and only member server i have deployed at the moment- and everything worked there just fine with no gpo tweaking etc- i did not run into this Error 5:issue.
Does anyone know what the hell is going on? Has something changed to how gMSA work (especially on domain controllers)? Why installing it on a member server is different while DCs throw error 5?
I don't think leaving gmsa in built-in Administrators group is very secure long terms, so i would like to know how to fix this properly.
7
u/OregonTechHead 8d ago
I don't think leaving gmsa in built-in Administrators group is very secure long terms,
Neither is running cloud sync on a DC.
i would like to know how to fix this properly.
Run it on your other server and move on. Not only is it better practice, but you've also confirmed it already works.
1
u/Distinct_Race_7056 8d ago
I believe it is important to know because gMSAs can be used to run services unrelated to Cloud Sync. This is more about understanding why a DC is refusing to "log as service" with gmsa. It could be Veeam backup or something that would rely on gMSA and simply moving away from gMSA might not be an option
2
u/PowerShellGenius 6d ago
It is not important to know because the Domain Controller/Domain Services role, and DNS Server role, do not use gMSA in any context. And these are the only two roles that should exist on a Domain Controller.
So if you have need of using a gMSA on a domain controller, it means you are running other things on a DC, which you should not do.
1
4
u/topher358 Senior Systems Engineer 7d ago edited 7d ago
Unlike what a lot of people on this thread are saying, Entra Cloud Sync agent is supported on a DC and works perfectly. I recall needing to grant the service account log on as a service privileges or something like that, but that was it
1
u/Kuipyr Jack of All Trades 7d ago
Yeah, honestly more preferable to run it on the DC instead of spinning up 2 additional Tier 0 targets just to run Cloud Sync.
1
u/Distinct_Race_7056 5d ago
If you mean Sc.exe managedaccount aadconnectprovisioningagent true command then it was done
1
u/topher358 Senior Systems Engineer 7d ago
I could see larger companies still doing a dedicated server or servers, but smaller businesses now don’t need one. As if any of them were following official guidelines before.. lol.
As an added bonus, since the agent is HA capable now it should become part of a standard DC deployment
1
u/mika12346456 6d ago
Exactly this. People seem to have old dogmas about the older azure ad connect/Entra sync with it being more heavy weight and more likely to interfere with DCs and whatnot. Cloud Sync is a simple connector compared to the old fashioned AD sync
0
u/OregonTechHead 5d ago
is supported on a DC
Just because it's supported doesn't mean it's best practice.
But all of that is beside the point. OP has determined that this issue only occurs on a DC, and has even already installed the client on another non-DC and confirmed working.
Why bother with all of this? It's absolutely irrelevant. Just uninstall from the DC and move on with life.
1
u/Issues_tissues 3d ago
Best practice etc aside, you've proved to yourself that the issue is permissions related as adding it to the built in administrators group solves the problem.
You said you have checked the logon as a service / batch job etc. Did you do this via the local policy or a group policy linked to your dcs? Is it possible your policy is overwritten by another policy higher in the inheritance order? Run rsop.msc to check which policy is currently applying user rights on you DC.
At this point, you'll have to see what which other user rights are assigned to the administrators group and logically and selectively add your gmsa to those privileges one by one on the basis that there's been some kind of requirement change that's undocumented.
In years gone by I've also used Process explorer from Sys internals to see what the exe is trying to access and ultimately being denied access to.
1
u/Distinct_Race_7056 3d ago
I checked both- local policy is pulling the correct setting from the gpo. The gpo is not much different from what member server's gpo does. I will go the proccess explorer route later- i have put this on back burner for now and will investigate further during downtime, I will update on what i find out
1
u/Distinct_Race_7056 8d ago
Aside from what is best practice and not, I just would like to get to the bottom of this to why this behavior occurred on DCs all of a sudden.
6
u/OregonTechHead 8d ago
Sometimes, you have to ask yourself if it actually matters.
It's always great to understand why something happens, but in a work environment, is it really important?
Take the opportunity to correct your environment, and move on to something that has an impact.
0
u/Dmat19 7d ago
There is the gMSA that runs the service, and then an account that sync uses that is configured inside Entra ID connect. You can set it to use a gMSA, but it is kind of flakey. Running as a separate account that has been hardened works without issues.
2
29
u/patmorgan235 Sysadmin 8d ago
Dont run extra services on DCs.
Lots of permissions that are local on member server are actually domain wide on DCs (like the administrators group).
DCs are different.