> ## Documentation Index > Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt > Use this file to discover all available pages before exploring further. # Create a gMSA for Use With SharpHound Enterprise export const word_0 = "Enterprise"

This page describes how to configure and run the SharpHound Enterprise collection tool using an Active Directory gMSA. To learn how to do this with SharpHound Community Edition, see [Create a gMSA for Use With SharpHound Community Edition](/collect-data/ce-collection/create-gmsa-community-edition). ## Overview of gMSAs Group Managed Service Accounts (gMSA) are managed domain accounts that provide automatic password management, simplified service principal name (SPN) management, and the ability to delegate the management to other objects. Detailed software requirements from Microsoft are available [here](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831782$v=ws.11$#software-requirements). Microsoft gMSA documentation is available [here](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831782$v=ws.11$). ## Create a gMSA account To create a gMSA account, start by preparing the domain. 1. Log into a domain controller within the domain you want to create a gMSA. 2. To validate whether the domain has a KDS Root Key configured, run: ``` Get-KdsRootKey ``` If there's no result returned, the KDS Root Key has not been configured in the domain. Continue on to step 3. If there is a result returned, the KDS Root Key has already been configured in the domain. Skip step 3 and move on to [Create the gMSA and password read group](#create-the-gmsa-and-password-read-group).

3. Create the KDS Root Key. For a production environment, run: ``` Add-KdsRootKey -EffectiveImmediately ```

For a test environment, make the key available for immediate use by running: ``` Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10)) ``` ## Create the gMSA and password read group Perform these steps from/against a writeable Domain Controller. 1. Create a gMSA password read group for computers that should have access to the gMSA password. Browse to the desired location in Users and Computers and create the group. Alternatively, use this template to create the group using PowerShell: ```json theme={null} $gmsaName = "t0_gMSA_SHS" # Name of the gMSA $pwdReadOUDN = "<DISGINGUISHED_NAME>" # Distinguished Name of OU to create the password read group in New-ADGroup ` -Name "$($gmsaName)_pwdRead" ` -GroupScope Global ` -GroupCategory Security ` -Path $pwdReadOUDN ` -Description "This group grants the rights to retrieve the password of the BloodHound data collector (SharpHound) gMSA '$gmsaName'." ` -PassThru ```

2. Add the SharpHound {word_0} server that performs the Sharphound collections as a member of the gMSA password read group. This allows it to access the password of the gMSA and run the service. Add the computer to the group in Users and Computers. Alternatively, use this template to add group membership using PowerShell: ```json theme={null} $gmsaName = "t0_gMSA_SHS" # Name of the gMSA $shServerDN = "<DISGINGUISHED_NAME>" # Distinguished Name of the SharpHound Enterprise server Add-ADGroupMember ` -Identity "$($gmsaName)_pwdRead" ` -Members $shServerDN ` -PassThru ```

When viewing the changes on a Windows server with the GUI enabled, you can see the OUs and the t0\_gMSA\_SHS\_pwdRead group you created. 3. Create the gMSA and allow the password read group to retrieve its password. On a Domain Controller, use this template to create the gMSA and set the retrieve right using PowerShell: ```json theme={null} $gmsaName = "t0_gMSA_SHS" # Name of the gMSA $gmsaOUDN = "<DISGINGUISHED_NAME>" # Distinguished Name of OU to create the gMSA in New-ADServiceAccount -Name $gmsaName ` -Description "SharpHound service account for BloodHound" ` -DNSHostName "$($gmsaName).$((Get-ADDomain).DNSRoot)" ` -ManagedPasswordIntervalInDays 32 ` -PrincipalsAllowedToRetrieveManagedPassword "$($gmsaName)_pwdRead" ` -Enabled $True ` -AccountNotDelegated $True ` -KerberosEncryptionType AES128,AES256 ` -Path $gmsaOUDN ` -PassThru ``` If you receive the error `"_New-ADServiceAccount : Key does not exist_"`, try again in 10 hours. This allows all Domain Controllers to converge AD replication of the KDS root key.

## Prepare the SharpHound {word_0} server 1. Restart the SharpHound Enterprise server so that the server's membership of the \`pwdRead\` group takes effect. 2. Grant the gMSA the "Log on as a service" User Rights Assignment on the SharpHound {word_0} server. This can be done through \`secpol.msc\` or policy deployment methods like a GPO. 3. (Optional) Test that the SharpHound {word_0} server can retrieve the gMSA password. See [Test the gMSA](#test-the-gmsa). ## Test the gMSA Optionally test the gMSA server to make sure that the gMSA is working. 1. Check the status of the RSAT PowerShell module. On the SharpHound Enterprise server, open a PowerShell as an Administrator and run: ```json theme={null} Get-WindowsCapability -Name RSAT* ```

If the Install State shows "Installed", skip to step 2, otherwise run: ``` Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online ```

2. In the elevated PowerShell, test that the SharpHound server can retrieve the gMSA password by running: ```json theme={null} $gmsaName = "t0_gMSA_SHS" # Name of the gMSA Test-ADServiceAccount -Identity $gmsaName ```

The test is successful if the command responds with `True`. The gMSA is now ready to be used on the SharpHound Enterprise server. Follow [Install and Upgrade SharpHound Enterprise](/install-data-collector/install-sharphound/installation-upgrade) to complete the installation of the SharpHound Enterprise service. ## Add the gMSA to the SharpHound Enterprise service Change the SharpHound Enterprise service to be run by the created gMSA. This can be done in two ways: ### Using Services GUI / 'services.msc' 1. Open the Services application / 'services.msc' as a local administrator. 2. Open properties of the service: **SharpHoundDelegator**. 3. In the **Log On** tab, set **This account** to be the gMSA. 4. Delete the contents of the password fields if present. 5. Save by clicking **OK**.

### Using command line / 'sc.exe' 1. Open the command prompt/PowerShell as a local administrator. 2. Run the following command, replacing the 'DOMAIN' and gMSA name to match your environment. ``` sc.exe config SHDelegator obj= "DOMAIN\\t0_gMSA_SHS$" ```