Comments on: What Happened to My Managed Service Accounts Container?

By: Dinny

Dinny — Thu, 27 Jun 2024 22:12:47 +0000

Thank you!

By: Carl Webster

Carl Webster — Fri, 22 Dec 2023 13:40:29 +0000

In reply to Scott.

No, I don’t know what it is for. I can’t find anything on it or the other. You could rename it and after running “ADPrep /domainPrep”, you can see if the two CNs were recreated.

Webster

By: Tony Minezzi

Tony Minezzi — Tue, 05 Dec 2023 17:03:48 +0000

Saved me! Thank you!!

By: Scott

Scott — Tue, 28 Nov 2023 17:21:28 +0000

In reply to Carl Webster.

Thanks. I have seen this article before but am confused as to what this object is.

CN=d262aae8-41f7-48ed-9f-35-56-bb-b6-77-57-3d

Would you happen to know what this object is for?

I also contacted Microsoft and they stated not to delete this. I will go with your recommendation.

By: Carl Webster

Carl Webster — Tue, 28 Nov 2023 16:05:46 +0000

In reply to Scott. Check this article: Dude, Where’s My Managed Service Accounts?

By: Scott

Scott — Tue, 28 Nov 2023 13:00:12 +0000

Question, your article states the following

” If you create a new AD domain with Windows Server 2008 R2 or later, when you look in Active Directory Users and Computers (ADUC), you see a container named Managed Services Accounts, as shown in Figure 1.”

What if your domain has been upgraded from the days of Windows 2000? Our AD does not shown the container but I would figure after all the forest and domain upgrades it should have appeared.

By: Carl Webster

Carl Webster — Tue, 25 Jul 2023 11:43:12 +0000

In reply to Aurelio Martin.

Do have Change Notification enabled? Microsoft recommends doing this change as it makes AD treat all DCs as if they were in one site. Greatly reduces your AD convergence time.

Get-ADObject -Filter ‘objectClass -eq “siteLink”‘ -SearchBase (Get-ADRootDSE).ConfigurationNamingContext | Set-ADObject -Replace @{Cost=100;ReplInterval=15;Options=5}

https://learn.microsoft.com/en-us/archive/blogs/ashleymcglone/report-and-edit-ad-site-links-from-powershell-turbo-your-ad-replication

Webster

By: Aurelio Martin

Aurelio Martin — Tue, 25 Jul 2023 10:00:41 +0000

Thanks for the information, it also worked for me.
In my case, with several domain controllers in different sites, we needed to wait for the ADSI edit changes to replicate to the other domain controllers, after step 12.
If we tried to run adprep /domainprep before replication, it failed with error “Domain-wide information has already been updated. [Status/Consequence] Adprep did not attempt to rerun this operation.”
After the ADSI edit changes were replicated to all domain controllers, the adprep /domainprep ran successfully “Adprep successfully updated the domain-wide information.”
And then we needed to wait again, for the replication to run to the other domain controllers, for the “Managed Service Accounts” container to show up.

By: ID10T

ID10T — Wed, 28 Jun 2023 14:55:52 +0000

thanks

By: Carl Webster

Carl Webster — Sat, 25 Mar 2023 13:03:55 +0000

In reply to Tony Auby. My AD mentors tell me that AD PoSH cmdlets are not the best way to get AD data. That is why Michael B. Smith's handprints are all over the AD doc script. Webster

By: Tony Auby

Tony Auby — Sat, 25 Mar 2023 12:02:32 +0000

Using Powershell, why does Get-ADObject not return gMSAs? ADUC lists them as ‘computer’ objects, but Get-ADComputer also will not return them. Get-ADGroup and Get-ADGroupMember will both show them as members. But you’d have to already know what they are ahead of time to identify them in a script, and say, retrieve their properties. You must use Get-ADService Account to retrieve them.

By: Cris Burke

Cris Burke — Tue, 07 Jun 2022 17:41:01 +0000

Thank you!
This worked perfectly!