Skip to content
MitoMito Docs

AD-MSA-01: Managed service account count should be investigated
ID AD-MSA-01
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Account security
Security area Applications and workload identities
Resource type Tenant
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”
  • Managed Service Accounts (MSAs) and Group Managed Service Accounts (gMSAs) provide significant security improvements over traditional service accounts by automating password management and simplifying service principal name (SPN) management.

Security Benefits:

  • Automatic Password Rotation: Passwords change automatically (every 30 days for gMSAs)
  • Eliminates Manual Management: No need for administrators to manage service account passwords
  • No Interactive Logon: Cannot be used for interactive logon, reducing attack surface
  • Reduced Credential Theft Risk: Passwords are complex and regularly changed
  • Simplified Administration: No manual password changes or coordination required

Types of Managed Service Accounts:

  • Standalone MSA: For use on a single computer (legacy, largely replaced by gMSA)
  • Group MSA (gMSA): Can be used across multiple computers, preferred solution

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

  1. Use gMSAs Where Possible:

    • Replace traditional service accounts with gMSAs
    • Prioritize high-privilege service accounts
    • Plan migration for legacy applications

  2. Implementation Requirements:

    • At least one Windows Server 2012 or later domain controller
    • KDS root key must be created (one-time operation)
    • Applications must support gMSA authentication

  3. Best Practices:

    • Use gMSAs for all new service deployments
    • Create separate gMSAs for different services
    • Document gMSA usage and permissions
    • Regular audit of gMSA deployments

How the Test Works

Section titled “How the Test Works”

This test counts managed service accounts in Active Directory and categorizes them by:

  • Total MSAs and gMSAs
  • Group vs. standalone MSAs
  • Account details and status
Section titled “Related Tests”
  • Test-MtAdUserKnownServiceAccountCount - Traditional service account identification
  • Test-MtAdKdsRootKeysCount - KDS root key requirement for gMSAs
  • Test-MtAdUserPasswordNeverExpiresCount - Traditional accounts with non-expiring passwords

References

Section titled “References”

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.