Skip to main content
NOT AVAILABLE IN SAAS.
If required — for example, for security reasons — a gMSA (Group Managed Service Account) or sMSA (Standalone Managed Service Account) can be used for the connection between the MS SQL Server database and the Application Server, instead of a standard SQL login. This guide uses “gMSA account” to refer to either type.

​
1. Set up a gMSA account

​
1.1 Create a KDS key

1

Add a KDS root key

Run in PowerShell:
This key is used to generate and rotate the gMSA password.
2

Confirm the key was added

Expected result: True.

​
1.2 Create the gMSA account

1

Enable gMSA support

2

Create an Active Directory group for target computers

Add the computers that will use this gMSA account to a new AD group (for example gmsaServers).
3

Create the account

For example:
-KerberosEncryptionType is optional but recommended, to avoid future Kerberos authentication issues.
4

Reboot the group's computers

Restart every computer added to the AD group above.

​
1.3 Install the gMSA account on target computers

Repeat on every computer that will use this gMSA account:
1

Install required modules

2

Install the account

3

Confirm installation

Expected result: True.

​
1.4 Grant “Log on as a service”

1

Open Local Security Policy

Run secpol.msc, go to Local Policies > User Rights Assignment, and add the gMSA account to the Log on as a service policy.
2

Repeat on every computer

Apply this on every computer where the gMSA account will run.

​
1.5 Grant access to system performance counters

1

Grant Perflib access

To prevent a “Access to the registry key ‘Global’ is denied” error on the System Health page, grant Full Control for the gMSA account on Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib.
2

Grant EventLog access

For the EkranServer service to start, grant Full control for the gMSA account on Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog.

​
1.6 Grant access to the Syteca install folder

For log data to be written correctly, grant Full control for the gMSA account on C:\Program Files\Ekran System\Ekran System.

​
2. Configure the Management Tool

​
2.1 The LDAP target

If using the gMSA account with an automatic LDAP target:
1

Run the Application Server under the gMSA account

In Windows Services, set the EkranServer service to run as the gMSA account.
2

Refresh the LDAP target

On Configuration > LDAP Targets, click Refresh Automatic LDAP Target for the target using this account.

​
2.2 Database and archive parameters

The gMSA account must be added under Logins in SQL Server Management Studio, with the db_owner permission granted.
1

Run both services under the gMSA account

Set both the EkranServer service and the SQL Server service to run as the gMSA account, in Windows Services.
2

Configure the database connection

Open Database Parameters (right-click the Syteca Server tray icon), and on the Metadata Storage sub-tab, select Windows Authentication and the Use process credentials checkbox.
The User Name and Password fields are disabled — the gMSA account’s credentials are used automatically.
3

Enter placeholder archive credentials

When configuring archive database parameters or adding an archived database, enter any values in the User and Password fields — they’re not actually used when the gMSA account is active, but the fields still require input.
Use Test Database Connection to confirm the Application Server can reach the archived database.

​
3. Troubleshooting

1

Verify the account

If this returns False, run:
2

Reboot the domain controller

Restart the computer hosting the domain controller after creating the gMSA account.
3

Confirm Log on as a Service permissions

Open secpol.msc > Local Policies > User Rights Assignment > Log on as a service.
4

Export the master certificate

Export EkranMasterCertificate.
5

Open mmc as the gMSA account

For example:
PsExec is part of the PsTools suite.
6

Import the master certificate

Import EkranMasterCertificate into both Personal and Trusted Root Certification Authorities.
1

Check registered SPNs

Confirm MSSQLSvc/<SQLServerFQDN> is registered for the gMSA account. Use Microsoft Kerberos Configuration Manager for SQL Server to check and fix SPNs, or run manually:
For example:
2

Verify the SPNs

3

Grant SPN write permissions

In Active Directory Users and Computers, enable Advanced Features, open the properties of the computer running EkranServer, and on the Security tab grant the gMSA account (or its AD group) Validated write to service principal name, plus Read servicePrincipalName and Write servicePrincipalName.
4

Grant the same permissions to SELF

For the group specified as PrincipalsAllowedToRetrieveManagedPassword, add Read and Write permissions for the SELF account the same way.
5

Fix error 18456, Severity 14, State 38

If this error appears in SQL Server logs, log in to SSMS as sa, open the SQL Server properties, and on the Permissions page grant Control server to the gMSA account.
EkranServer, EkranMasterCertificate, and the default install path are literal system identifiers, preserved verbatim from source.

Database parameters

Configure the database connection and binary storage location.

Windows Authentication and NTLM

An alternative fix for NTLM-related authentication errors.

Master certificate

Export and import the certificate referenced in troubleshooting above.