Yes, we can use a Managed Service Account (MSA) for the eOne Window Service Scheduler or eOne SmartConnect API Service. The only consideration is that the password is automatically managed by the Windows Service Control Manager (SCM) on the machine where the service is running. As a result, it will not cause any interruptions when starting, stopping, or pausing the service
An MSA account must have at least local administrator permissions on the machine, so add the account into local machines administrator group.
Here’s a key distinction between Managed Service Accounts (MSA) and Domain Service/User Accounts Accounts:
- MSA: Active Directory automatically manages the password, including rotation (typically every “x” day based on AD settings). On the other hand, Domain Service/User Accounts require manual password management with a password expiration policy as optional.
- MSA: This account type is designed for services running on a single machine. Domain Service/User Accounts used across domains. For services running across multiple machines, it’s better to use Group Managed Service Accounts (gMSA) instead of MSA.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-service-accounts
https://techcommunity.microsoft.com/blog/askds/managed-service-accounts-understanding-implementing-best-practices-and-troublesh/397009
| Feature | Managed Service Accounts (MSA) | Domain Service/User Accounts |
| Password Management | Automatically managed by Active Directory, including regular rotation | Requires manual password management with no automatic rotation |
| Password Expiration | No manual intervention is needed; AD handles expiration and updates | No built-in expiration policy; must be managed manually |
| Service Association | Tied to a single machine (Standalone MSA) or multiple machines (Group MSA) | Can be used across multiple machines |
| Security | More secure due to automatic password rotation and elimination of hardcoded credentials | Less secure if passwords are not regularly changed manually |
| Configuration Complexity | Easier to manage since AD automates password changes | Requires administrative effort to maintain password policies |
| Usage | Ideal for services running on a specific machine or group of machines | Commonly used for applications and services that need access across multiple servers |
In SmartConnect 21, MSA does not have a password, the SmartConnect Configuration screen will show the following message during installation.
For: eOne Windows Service:
For: eOne API Service:
To proceed, use a different account (either a domain user or a domain service user) with at least local administrator permissions on the machine to install the service.
For Example: As outlined in Step 7 below.
https://www.eonesolutions.com/help-article/how-to-reinstall-the-smartconnect-21-scheduler-service/
we need to change the account later after the installation.
Once SmartConnect Window Service Installed >>
- Open the Start menu, select ‘Run’ and type services.msc, then press ‘Enter’.
- In the Services window, locate eOne SmartConnect Service.
- Right-click the service and select ‘Properties‘. Navigate to the Log On tab, enter your MSA service account ID (or browse if needed), and leave the password field blank.
- Then, go to the General tab and start the service.
Once SmartConnect API Service Installed >>
- Open the Start menu, select Run, type inetmgr, and press ‘Enter‘.
- In Application Pools, locate SmartConnectWcf.
- Right-click and select ‘Advanced Settings’. Under the Process Model section, find Identity, then select ‘Custom Account > Set‘. Enter your MSA service account ID and leave the password field blank.
- Right-click and select ‘Recycling’ to restart the service. Ensure you can browse the SmartConnectWcf website under the Sites section. If needed, restart IIS to ensure the services function as expected.
According to Microsoft, this is a warning (not an error) and “can typically be ignored.”
https://techcommunity.microsoft.com/blog/iis-support-blog/iis-manager-shows-authorization-warning-when-testing-a-physical-path/287861
Have a question? Please reach out to us at support@eonesolutions.com
