Create an Active Directory Managed Service Account for NIM

Microsoft Active Directory guide

Create a single-computer Active Directory managed service account (MSA) for the Tools4ever NIM Service, test it on the NIM server, and delegate the required directory permissions.

At a glanceDirect link to At a glance

This procedure creates an MSA for one NIM server using New-ADServiceAccount -RestrictToSingleComputer. Link the account to that server, install it locally, and confirm that Test-ADServiceAccount returns True. Then delegate permissions to the organizational units and object types NIM needs to manage, and assign the account to the NIM Windows service.

MSA or gMSA? The commands below create a single-computer MSA. A group managed service account (gMSA) is a different account type; see Microsoft's New-ADServiceAccount account types and examples before choosing a procedure for your environment.

Before you beginDirect link to Before you begin

Microsoft's group managed service account guidance provides background on managed credentials and service account ownership. This guide creates a single-computer MSA with -RestrictToSingleComputer; confirm which managed account type your environment requires before following the commands. In either case, delegate directory rights separately to the scope NIM manages.

Requirement	Check before continuing
Account type	Use a single-computer MSA for this procedure. Do not use these commands as a gMSA setup guide.
NIM server	Identify the domain-joined Windows server that will host the account. Install and test the MSA on that server.
PowerShell module	Run `Get-Module -ListAvailable ActiveDirectory`. If the module is missing, have the server administrator install the Active Directory PowerShell management tools.
Permissions	Use an elevated PowerShell session on the NIM server. The executing account also needs delegated directory permissions to create the MSA and associate it with the computer; local administrator rights alone do not grant those AD permissions.
Account and computer names	Choose an unused account name and confirm the NIM server's AD computer name.
Delegation scope	Identify the organizational units and object types NIM will manage. Grant those rights separately after creating the account.

Create and install the service accountDirect link to Create and install the service account

1. Create the managed service accountDirect link to 1. Create the managed service account

New-ADServiceAccount -Name <NAMEOFACCOUNT> -RestrictToSingleComputer

Where the managed service account is storedDirect link to Where the managed service account is stored

By default, the MSA is created in the domain's Managed Service Accounts container, such as CN=Managed Service Accounts,DC=example,DC=com. Use the -Path parameter on New-ADServiceAccount to select a different container or organizational unit. -RestrictToSingleComputer selects the single-computer account type.

2. Link the account to the NIM serverDirect link to 2. Link the account to the NIM server

Replace <NIMSERVERNAMEHERE> with the name of the NIM server and <NAMEOFACCOUNT> with the MSA you created.

$TargetServer = Get-ADComputer -Identity <NIMSERVERNAMEHERE>
Add-ADComputerServiceAccount -Identity $TargetServer -ServiceAccount <NAMEOFACCOUNT>

3. Verify and install the accountDirect link to 3. Verify and install the account

Get-ADServiceAccount <NAMEOFACCOUNT>
Install-ADServiceAccount -Identity <NAMEOFACCOUNT>
Test-ADServiceAccount <NAMEOFACCOUNT>

Test-ADServiceAccount should return True. After installation, follow the Configure connection guide to assign the account to the NIM Windows service.

Complete example: create an MSA for one NIM serverDirect link to Complete example: create an MSA for one NIM server

This example creates NimSvc for the AD computer NIM01. Replace both names with your environment's values and run the commands on the intended NIM server using an account with the permissions listed above. If the MSA already exists, skip New-ADServiceAccount and verify the existing account and its host association before installing it.

Import-Module ActiveDirectory

$nimAccountName = 'NimSvc'
$nimComputerName = 'NIM01'

New-ADServiceAccount -Name $nimAccountName -RestrictToSingleComputer
$nimComputer = Get-ADComputer -Identity $nimComputerName
Add-ADComputerServiceAccount -Identity $nimComputer -ServiceAccount $nimAccountName

Install-ADServiceAccount -Identity $nimAccountName
Test-ADServiceAccount -Identity $nimAccountName

Expected final output: True. This confirms that the account is ready for use on the local computer. It does not confirm the directory permissions NIM needs to create users or modify memberships. Continue with delegation below before using the account for those operations.

Microsoft documents account creation, host association, and local installation separately: New-ADServiceAccount, Add-ADComputerServiceAccount, and Install-ADServiceAccount.

Delegate Active Directory permissionsDirect link to Delegate Active Directory permissions

Use least privilegeDelegate permissions only to the organizational units and object types that NIM manages.

Create an Active Directory group for the MSA and add the MSA as a member.
In Active Directory Users and Computers, right-click the domain root or the relevant organizational unit, then select Delegate Control.
Add the group you created and delegate the tasks NIM requires. Common permissions include:
- Create, delete, and manage user accounts
- Reset user passwords and force password change at next sign-in
- Read all user information
- Modify group membership
On the NIM server, grant that group Full control to:
- C:\ProgramData\Tools4ever\NIM
- C:\Program Files\Tools4ever\NIM\sysconfig

Troubleshoot managed service account setupDirect link to Troubleshoot managed service account setup

Symptom	What to check
AD commands are not recognized	Confirm that the Active Directory module is installed and `Import-Module ActiveDirectory` succeeds in this session.
The account or computer cannot be found	Check the account and AD computer names with `Get-ADServiceAccount` and `Get-ADComputer`. Confirm that you are querying the intended domain.
Creation or host association returns Access denied	Check the executing account's AD permissions on the account container and computer object. Running PowerShell as a local administrator does not replace directory delegation.
`Install-ADServiceAccount` fails	Confirm that the account exists, is associated with the intended computer, and is being installed on that computer. Check domain connectivity and the command's error before continuing.
`Test-ADServiceAccount` returns `False`	Stop before changing the NIM service identity. Confirm the account type, intended host association, successful local installation, and domain connectivity. Use Microsoft's Test-ADServiceAccount reference to interpret what the local test checks.
The test returns `True`, but NIM receives Access denied	Verify the actual NIM service identity and the delegated rights on the affected AD object. Follow the Active Directory permission checks.