Citrix DaaS

On-premises Active Directory service accounts

December 10, 2024

Contributed by:

An on-premises Active Directory service account is a container to store the user name and password of a privileged domain user account. The user account must have sufficient permissions to manage computer accounts in an Active Directory. Machine Creation Service can use this service account to do computer accounts related operations without entering the domain credentials every time.

Create an on-premises Active Directory service account

Create an on-premises Active Directory service account using Studio or PowerShell.

Prerequisite

To create an on-premises Active Directory service account, make sure to complete the following task:

Create a domain user account in your Active Directory with sufficient permissions to create, update, and delete computer objects in your Active Directory or specific OUs.

Use Studio

In the DaaS tile, click Manage.
In the left pane, select Administrators.
In the Service Accounts tab, click Create Service Account.
On the Identity Type page, select On-premises Active Directory. Click Next.
On the Credentials page, click Enter credentials to provide the username and password of a privileged domain user account which you want to use as the service account.
Set the password expiration date or leave it as never expired.
Select one or more scopes for this service account.
Enter a friendly name and a description (optional) for the service account.
Click Finish to complete the creation.

Use PowerShell

You can use PowerShell commands to create an on-premises Active Directory service. For example:

$credential = ConvertTo-SecureString -String $password -AsPlainText -Force
New-AcctServiceAccount -IdentityProviderType ActiveDirectory -IdentityProviderIdentifier test.local -AccountId test\svcacct_mcs -AccountSecret $credential -SecretExpiryTime 2030/08/15 -DisplayName 'scvacct_mcs' -Description 'Service account for test.local'
<!--NeedCopy-->

Note:

The $password is the matching password for the provided domain user account.

After an Active Directory or a Hybrid Azure AD based identity pool is associated with a service account, you can do various machines identity-related actions without requiring to enter the domain credentials.

To create a new identity account using a service account

 New-AcctADAccount -IdentityPoolName MyPool -Count 2 -UseServiceAccount
 <!--NeedCopy-->

To repair the identity accounts using a service account

 Repair-AcctADAccount -ADAccountName "Domain\account","Domain\account2" -UseServiceAccount
 <!--NeedCopy-->

To remove identity accounts using service account

 Remove-AcctADAccount -IdentityPoolName MyPool -RemovalOption Delete -ADAccountName "Domain\account","domain\account2" -UserServiceAccount
 <!--NeedCopy-->

Where to go next

To create on-premises Active Directory joined catalogs, see Identity pool of on-premises Active Directory joined machine identity.
To manage service accounts, see Manage service accounts.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

On-premises Active Directory service accounts

December 10, 2024

Contributed by:

December 10, 2024

Contributed by:

On-premises Active Directory service accounts

Create an on-premises Active Directory service account

Prerequisite

Use Studio

Use PowerShell

Perform machines identity-related actions

Where to go next

In this article