How to configure Continuity Engine services with Group Managed Service Accounts

How to configure Continuity Engine services with Group Managed Service Accounts

Summary

This Knowledgebase article provides information about how to configure Continuity Engine services with Group Managed Service Accounts (gMSA).

Procedure

Engine Management Service

gMSA accounts can be used as Log On accounts for Engine Management Service’s nfmgtwebsvc service providing the following conditions:
  • (EMS1) gMSA account must be installed on the EMS server
  • (EMS2) gMSA account must be member of local administrators group

Continuity Engine

gMSA accounts can be used as Log On accounts for Engine’s nfserverr2, nfwebcvs, and ScopeSvc services providing the following conditions:

  • (CE1) gMSA account must be installed on the Engine server

  • (CE2) gMSA account must be member of local administrators group

  • (CE3) gMSA account must have Read permissions for the following registry keys: HKEY_LOCAL_MACHINE\SECURITY\POLICY and HKEY_LOCAL_MACHINE\SECURITY

How to install and configure Continuity Engine services with gMSA

It is recommended to firstly install Continuity Engine cluster (Primary + standby nodes) using the defaults, i.e. Local System account. Then, post installation, reconfigure Engine services to use the gMSA account.

Requirements:

  • If EMS service is configured with a gMSA account (EMS1), then, before installing Engine on the Primary server, assure conditions (CE1) and (CE2) and (CE3) are met for the target (Primary) server

Engine installation:

  • deploy Continuity Engine cluster using its default configured services log on account (Local System)

Post Engine installation on Primary:

  • by default, Engine services are configured with Local System account during the installation on Primary server. Considering the above (CE1), (CE2 ) and (CE3) conditions are met:

    • On Primary: configure Engine services to run under the gMSA log on account

    • On standby Secondary/Tertiary:

      • make Secondary/Tertiary active

      • check that (CE1), (CE2) and (CE3) conditions are fulfilled

      • configure Engine services to run under the gMSA log on account

Known limitations

  • Adding or Configuring User Account for Tasks when NFServerR2 is configured with gMSA account requires that gMSA account is allowed to Replace a process level token (configured in Local Security Policies → Local Policies → User Right Assignment). This configuration must be done on all the Engine nodes.

  • gMSA accounts are not supported (cannot be configured as Run As) by DNSUpdate task

  • gMSA accounts are not supported by Engine plugin configuration

  • gMSA account is not preserved during EMS and Engine upgrades: they’re replaced with the defaults.


    • Related Articles

    • How to Configure Application Services In Neverfail Continuity Engine

      Summary This Knowledgebase article provides information about how to configure application services in Neverfail Continuity Engine.  More Information  Services page The Engine Management Service Services page shows services specified by plug-ins or ...

    • Engine Management Service API

      Summary This knowledgebase article provides information about Engine Management Service (EMS) API: frequently used API endpoints (applicable to all supported CE versions) procedure for enabling, capturing and viewing Swagger API documentation (valid ...

    • Continuity Engine Product Architecture

      Learning objectives At the completion of this session, you should be able to: Identify major components of the Neverfail Continuity Engine product architecture. Describe major component configuration. Identify advantages of the Neverfail Continuity ...

    • Neverfail IT Continuity Engine v8.0 - Release Notes

      Summary This Knowledge base article provides information about this specific release of Neverfail IT Continuity Engine v8.0 More Information Supporting Documentation A listing of technical documents supporting this version of Neverfail IT Continuity ...

    • How to Create a Task In Neverfail Continuity Engine

      Summary This Knowledge base article provides general information about how to create Tasks in Neverfail Continuity Engine. More Information Tasks are a generalization and extension of start, stop, and monitor scripts. Task types are grouped by when ...