---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# gMSA configuration for Discovery

# gMSA configuration for Discovery {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 8, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Group managed service accounts (gMSAs) are managed domain accounts that you use to help
secure services. gMSAs can be used for credential-less Discovery.

## Benefits {#gmsa-configuration-for-discovery__section_tlf_1xb_krb}

After you configure Discovery to use gMSA, password management for that account is handled by the Windows operating system. So, you can run Windows Discovery without sharing credentials with the ServiceNow instance. Benefits include the following:

* You don't have to handle gMSA passwords on your own.
* You can choose the cycle of gMSA password rotation for better security.
* You don't need to store the password on the ServiceNow instance.
* The gMSA user doesn't need to be member of a domain admin group.
* The gMSA user used as the MID Server service account doesn't need to be on the local admin group of the MID Server.
{#gmsa-configuration-for-discovery__ul_ztj_vwb_krb}

## Configure gMSA for Discovery {#ariaid-title2}

Use Group Managed Service Accounts (gMSA) to securely run MID Servers and perform Windows discovery without storing passwords locally. This configuration improves security and simplifies credential management by leveraging Active Directory for automatic password rotation and centralized
control.

### Before you begin

* Verify that the gMSA account is created and configured in Active Directory.
* Add the gMSA accounts to the MID Server host's local Administrator's group.
* For target servers, add the gMSA account to their local Administrator's group.

{#configure-gmsa-for-discovery__ul_mh5_v5k_thc}

Role required: agent_admin, discovery_admin, or admin

### Procedure

1. On the PowerShell command line, create a KDS Root key on a Domain Controller using the following commands:  

       Add-KdsRootKey -EffectiveImmediately

   or

       Add-KdsRootKey --EffectiveTime ((Get-Date).AddHours(-10))

2. Set up your gMSA and security groups using the group managed services account information <https://docs.microsoft.com>.  
   Note:  
   It's not usually necessary to add discovered Windows servers to the GMSAGroup. Member hosts obtain the current and previous password values directly from a domain controller, and Discovery doesn't require this step.
3. Start the MID Server with the gMSA account following the directions here on using gMSA: [Install a MID Server on Windows](https://www.servicenow.com/docs/access?context=mid-server-install-prereqs&version=yokohama&pubname=yokohama-servicenow-platform&ft:locale=en-US)
4. Create a Windows credential on the instance and select the check box Use MID Server Service Account.
5. Launch a Discovery on the server hosting the MID Server and another computer.