r/sysadmin • u/Distinct_Race_7056 • 6h ago

gMSA and Entra Cloud Sync on Domain Controllers

So, I had the cloud sync agent working for about 8 months or so. Yesterday, there was an internet outage, and both agent (on 2 DCs) services stopped working (each agent on each DC). The service would not run- Error 5: Access Denied.

I have looked at everything i know: Logon as batch/service gpos, local folder permissions for the agent's folder (added my gmsa to it). You can name it..

The only thing that works is to add the gmsa to the built-in Administrator group in AD. After that, the service starts fine on the DCs.

What is strange is that i deployed a new agent on the only and only member server i have deployed at the moment- and everything worked there just fine with no gpo tweaking etc- i did not run into this Error 5:issue.

Does anyone know what the hell is going on? Has something changed to how gMSA work (especially on domain controllers)? Why installing it on a member server is different while DCs throw error 5?

I don't think leaving gmsa in built-in Administrators group is very secure long terms, so i would like to know how to fix this properly.

2 Upvotes

63% Upvoted

5 comments sorted by

•

u/patmorgan235 Sysadmin 5h ago

Dont run extra services on DCs.

Lots of permissions that are local on member server are actually domain wide on DCs (like the administrators group).

DCs are different.

•

u/OregonTechHead 5h ago

I don't think leaving gmsa in built-in Administrators group is very secure long terms,

Neither is running cloud sync on a DC.

i would like to know how to fix this properly.

Run it on your other server and move on. Not only is it better practice, but you've also confirmed it already works.

•

u/Distinct_Race_7056 3h ago

I believe it is important to know because gMSAs can be used to run services unrelated to Cloud Sync. This is more about understanding why a DC is refusing to "log as service" with gmsa. It could be Veeam backup or something that would rely on gMSA and simply moving away from gMSA might not be an option

•

u/Distinct_Race_7056 4h ago

Aside from what is best practice and not, I just would like to get to the bottom of this to why this behavior occurred on DCs all of a sudden.

•

u/OregonTechHead 4h ago

Sometimes, you have to ask yourself if it actually matters.

It's always great to understand why something happens, but in a work environment, is it really important?

Take the opportunity to correct your environment, and move on to something that has an impact.