Skip to content

Commit 3efe201

Browse files
sdwheelersdwheeler
authored
Merge pull request MicrosoftDocs#3752 from Xelu86/ADServiceAccount_DMSA
Adding new AD cmdlets for DMSAs
2 parents 1ac9a86 + 24094f5 commit 3efe201

File tree

6 files changed

+1290
-197
lines changed

6 files changed

+1290
-197
lines changed

‎docset/winserver2025-ps/activedirectory/ActiveDirectory.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,9 @@ Clears the expiration date for an Active Directory account.
4545
### [Clear-ADClaimTransformLink](./Clear-ADClaimTransformLink.md)
4646
Removes a claims transformation from being applied to one or more cross-forest trust relationships in Active Directory.
4747

48+
### [Complete-ADServiceAccountMigration](./Complete-ADServiceAccountMigration.md)
49+
Completes the migration process of a service account to a delegated managed service account.
50+
4851
### [Disable-ADAccount](./Disable-ADAccount.md)
4952
Disables an Active Directory account.
5053

@@ -342,6 +345,9 @@ Removes an Active Directory user.
342345
### [Rename-ADObject](./Rename-ADObject.md)
343346
Changes the name of an Active Directory object.
344347

348+
### [Reset-ADServiceAccountMigration](./Reset-ADServiceAccountMigration.md)
349+
Resets and unlinks the delegated managed service account from the user account.
350+
345351
### [Reset-ADServiceAccountPassword](./Reset-ADServiceAccountPassword.md)
346352
Resets the password for a standalone managed service account.
347353

@@ -447,12 +453,18 @@ Modifies an Active Directory user.
447453
### [Show-ADAuthenticationPolicyExpression](./Show-ADAuthenticationPolicyExpression.md)
448454
Displays the Edit Access Control Conditions window update or create security descriptor definition language (SDDL) security descriptors.
449455

456+
### [Start-ADServiceAccountMigration](./Start-ADServiceAccountMigration.md)
457+
Starts the migration of a user account to a delegated managed service account.
458+
450459
### [Sync-ADObject](./Sync-ADObject.md)
451460
Replicates a single object between any two domain controllers that have partitions in common.
452461

453462
### [Test-ADServiceAccount](./Test-ADServiceAccount.md)
454463
Tests a managed service account from a computer.
455464

465+
### [Undo-ADServiceAccountMigration](./Undo-ADServiceAccountMigration.md)
466+
Reverts the migration phase of delegated managed service account to a user account.
467+
456468
### [Uninstall-ADServiceAccount](./Uninstall-ADServiceAccount.md)
457469
Uninstalls an Active Directory managed service account from a computer or removes a cached group managed service account from a computer.
458470

‎docset/winserver2025-ps/activedirectory/Complete-ADServiceAccountMigration.md

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,238 @@
1+
---
2+
description: Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.
3+
external help file: Microsoft.ActiveDirectory.Management.dll-Help.xml
4+
Module Name: ActiveDirectory
5+
ms.date: 02/15/2024
6+
online version: https://learn.microsoft.com/powershell/module/activedirectory/complete-adserviceaccountMigration?view=windowsserver2025-ps&wt.mc_id=ps-gethelp
7+
schema: 2.0.0
8+
title: Complete-ADServiceAccountMigration
9+
---
10+
11+
12+
# Complete-ADServiceAccountMigration
13+
14+
## SYNOPSIS
15+
Completes the migration process and supersedes a normal user account to a delegated managed service
16+
account.
17+
18+
## SYNTAX
19+
20+
### ADServiceAccountMigrationParameterSet (Default)
21+
22+
```
23+
Complete-ADServiceAccountMigration [-AuthType <ADAuthType>] [-Credential <PSCredential>]
24+
[-Identity] <ADServiceAccount> [-SupersededAccount <String>] [-Server <String>]
25+
[<CommonParameters>]
26+
```
27+
28+
## DESCRIPTION
29+
30+
The `Complete-ADServiceAccountMigration` cmdlet will complete the migration process of superseding
31+
a normal user account specificed by the distinguished name string provided in the
32+
**SupersededAccount** parameter to the delegated managed service account provided in the
33+
**identity** parameter. They must've been previously linked via the
34+
`Start-ADServiceAccountMigration` cmdlet.
35+
36+
The **Identity** parameter specifies the delegated managed service account to use. You can identify
37+
a managed service account by its distinguished name, GUID, security identifier (SID), or Security
38+
Account Manager (SAM) account name.
39+
40+
The **SupersededAccount** parameter specifies the user account that's linked to the delegated
41+
managed service account. The superseded account must be identified by its distinguished name.
42+
43+
## EXAMPLES
44+
45+
### Example 1: Complete a service account migration using the Security Account Manager name of the delegated managed service account
46+
47+
```powershell
48+
$params = @{
49+
Identity = "delegatedSvc1"
50+
SupersededAccount = "CN=User1,OU=Accounts,DC=Contoso,DC=com"
51+
}
52+
Complete-ADServiceAccountMigration @params
53+
```
54+
55+
### Example 2: Complete a service account migration by specifying a 2025 Domain Controller
56+
57+
```powershell
58+
$params = @{
59+
Identity = "delegatedSvc1"
60+
SupersededAccount = "CN=User1,OU=Accounts,DC=Contoso,DC=com"
61+
Server = "2025DC.Contoso.com"
62+
}
63+
Complete-ADServiceAccountMigration @params
64+
```
65+
66+
## PARAMETERS
67+
68+
### -AuthType
69+
70+
Specifies the authentication method to use.
71+
The acceptable values for this parameter are:
72+
73+
- Negotiate or 0
74+
- Basic or 1
75+
76+
The default authentication method is Negotiate.
77+
78+
A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.
79+
80+
```yaml
81+
Type: ADAuthType
82+
Parameter Sets: (All)
83+
Aliases:
84+
Accepted values: Negotiate, Basic
85+
86+
Required: False
87+
Position: Named
88+
Default value: None
89+
Accept pipeline input: False
90+
Accept wildcard characters: False
91+
```
92+
93+
### -Credential
94+
95+
Specifies the user account credentials to use to perform this task. The default credentials are the
96+
credentials of the currently logged on user unless the cmdlet is run from an Active Directory
97+
module for Windows PowerShell provider drive. If the cmdlet is run from such a provider drive, the
98+
account associated with the drive is the default.
99+
100+
To specify this parameter, you can type a user name, such as `User1` or `Domain01\User01` or you
101+
can specify a **PSCredential** object. If you specify a user name for this parameter, the cmdlet
102+
prompts for a password.
103+
104+
You can also create a **PSCredential** object by using a script or by using the `Get-Credential`
105+
cmdlet. You can then set the *Credential* parameter to the **PSCredential** object.
106+
107+
If the acting credentials don't have directory-level permission to perform the task, Active
108+
Directory module for Windows PowerShell returns a terminating error.
109+
110+
```yaml
111+
Type: PSCredential
112+
Parameter Sets: (All)
113+
Aliases:
114+
115+
Required: False
116+
Position: Named
117+
Default value: None
118+
Accept pipeline input: False
119+
Accept wildcard characters: False
120+
```
121+
122+
### -Identity
123+
124+
Specifies an Active Directory account object by providing one of the following property values. The
125+
identifier in parentheses is the LDAP display name for the attribute. The acceptable values for
126+
this parameter are:
127+
128+
- A distinguished name
129+
- A GUID (objectGUID)
130+
- A security identifier (objectSid)
131+
- A SAM account name (sAMAccountName)
132+
133+
The cmdlet searches the default naming context or partition to find the object.
134+
If two or more objects are found, the cmdlet returns a non-terminating error.
135+
136+
```yaml
137+
Type: ADServiceAccount
138+
Parameter Sets: ADServiceAccountMigrationParameterSet
139+
Aliases:
140+
141+
Required: True
142+
Position: 0
143+
Default value: None
144+
Accept pipeline input: False
145+
Accept wildcard characters: False
146+
```
147+
148+
### -SupersededAccount
149+
150+
Specifies the user account that you want to be migrated to a delegated managed service account. The
151+
account must be specified by it's distinguished name.
152+
153+
```yaml
154+
Type: String
155+
Parameter Sets: ADServiceAccountMigrationParameterSet
156+
Aliases:
157+
158+
Required: True
159+
Position: Named
160+
Default value: None
161+
Accept pipeline input: False
162+
Accept wildcard characters: False
163+
```
164+
165+
### -Server
166+
167+
Specifies the Active Directory Domain Services instance to connect to, by providing one of the
168+
following values for a corresponding domain name or directory server. The service may be any of the
169+
following: Active Directory Lightweight Domain Services, Active Directory Domain Services or Active
170+
Directory Snapshot instance.
171+
172+
Domain name values:
173+
174+
- Fully qualified domain name (FQDN)
175+
- NetBIOS name
176+
177+
Directory server values:
178+
179+
- Fully qualified directory server name
180+
- NetBIOS name
181+
- Fully qualified directory server name and port
182+
183+
The default value for the **Server** parameter is determined by one of the following methods in the
184+
order that they are listed:
185+
186+
- By using **Server** value from objects passed through the pipeline.
187+
- By using the server information associated with the Active Directory PowerShell provider drive,
188+
when running under that drive.
189+
- By using the domain of the computer running PowerShell.
190+
191+
```yaml
192+
Type: String
193+
Parameter Sets: (All)
194+
Aliases:
195+
196+
Required: False
197+
Position: Named
198+
Default value: None
199+
Accept pipeline input: False
200+
Accept wildcard characters: False
201+
```
202+
203+
### CommonParameters
204+
205+
This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`,
206+
`-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`,
207+
`-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see
208+
[about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216).
209+
210+
## INPUTS
211+
212+
### Microsoft.ActiveDirectory.Management.ADServiceAccount
213+
214+
A delegated managed service account object is received by the **Identity** parameter.
215+
216+
## NOTES
217+
218+
- This cmdlet doesn't work with AD LDS.
219+
- This cmdlet doesn't work with an Active Directory snapshot.
220+
- This cmdlet doesn't work with a read-only domain controller.
221+
- This cmdlet requires that you create a Microsoft Group Key Distribution Service (GKDS) root key
222+
first to begin using group managed service accounts in your Active Directory deployment. For more
223+
information on how to create the GKDS root key using Windows PowerShell, see
224+
[Create the Key Distribution Services KDS Root Key](https://go.microsoft.com/fwlink/?LinkId=253584).
225+
226+
## RELATED LINKS
227+
228+
[Reset-ADServiceAccountMigration](./Reset-ADServiceAccountMigration.md)
229+
230+
[Start-ADServiceAccountMigration](./Start-ADServiceAccountMigration.md)
231+
232+
[Undo-ADServiceAccountMigration](./Undo-ADServiceAccountMigration.md)
233+
234+
[Get-ADServiceAccount](./Get-ADServiceAccount.md)
235+
236+
[New-ADServiceAccount](./New-ADServiceAccount.md)
237+
238+
[Set-ADServiceAccount](Set-ADServiceAccount.md)

0 commit comments

Comments
 (0)