Support Group Managed Service Account (gMSA) authentication for WMI server monitoring

1. Currently we monitor Windows Servers using (WMI/WinRM).

2. To monitor Windows Servers we need a dedicated Service Account

   1. Local Admin

   2. Domain User with Elevated Access

   3. Domain Admin (Preferred)

3. We currently Monitor AD servers using (WMI/WinRM) using Domain Admin account. (Since microsoft only support Domain Admin accounts to be used to monitor Windows AD).

   1. This is a security risk for the customer as they have to feed in Domain Admin Credentials for the AD server in Netreo.

   2. Though these credentials are encrypted and saved in Netreo.

      1. They are not automatically updated or life cycle managed.

   3. So they need to manually enter them in Netreo, when they change. Typically in an enterprise environment. Customer tend to update Domain Admin account credentials every 3 months, this is a manual work and involves hard credential queries.

4. Recently(2~3 years ago) Microsoft suggested the path to use “MSA” or “gMSA” more recently as a methods to monitor Windows Servers.

   1. Using this method, we won’t store the credentials locally in Netreo but use KDS exchange to authenticate via the gMSA account that has Domain Admin privileges to monitor the Windows Servers.

   2. This reduces the risk from the customer POV as:

      1. No credentials are stored in Netreo.

      2. life cycle management of credentials wont be think as they are auto-managed on the AD side for the gMSA account.

Here are reference Microsoft Articles:

1. https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview