Configure MES Middleware Host services to use a gMSA

If you require centralized management of service accounts for security or operational reasons, you can configure the MES Middleware Host service to use Group Managed Service Accounts (gMSAs). This configuration is optional and depends on your organization’s IT policies.

gMSAs serve the same purpose as virtual service accounts, but operate as domain accounts. This means that you can use a single account across multiple computers and services.

We recommend creating a separate gMSA for each service to support granular management and process isolation. If isolation is not required, you can use a single gMSA across all applicable services requiring Group Policy Object (GPO)-based management.

This procedure describes how to configure MES Middleware Host services to use a gMSA as the login identity. For information on how to manage MES service accounts using Active Directory GPO with gMSAs, refer to the Microsoft procedure for managing gMSAs (Group Managed Service Accounts).

Important: The MES Workflow Connector service does not support gMSA service accounts. Leave the service configured with the default Network Service account.

For information on managing gMSAs for System Platform, refer to the AVEVA Customer Support portal article.

Configure MES Middleware Host services to use a gMSA

Perform these steps on each computer where the MES Middleware Host service is installed. Perform this procedure as a domain or network administrator.

Notes: In a distributed environment, the MES Middleware Proxy machine must be configured to connect to the MES Middleware Host service using the HTTP protocol when the Middleware Host service is running under a gMSA account. The TCP protocol is not supported in this scenario.

Reapply this configuration after an MES upgrade or reinstall. You do not need to run Install-ADServiceAccount for gMSAs.

1. Open the Services control panel.

2. Locate MES Middleware Host.

3. Right-click the service and select Properties.

4. On the Log On tab, enter the gMSA account name (for example, gMSAForServices$).

   Ensure that you append $ after the account name. Leave the Password field blank.

5. Select Apply.

   When configuring the service, the account will automatically be granted the Log On As A Service right.

6. Restart the computer to apply the group membership changes.

7. Confirm the gMSA account is a member of the Administrators group in the Group Policy Management Editor.

   

8. Confirm that the MES Middleware Host service starts and runs under the gMSA account.

   Important: If you change the user account after configuring the MES DB/MW Communication component, perform the configuration again. For additional information about changing the service's Windows user account if the MES middleware and database are on different server nodes, see Guidelines for changing the MES Middleware Service Windows User Account.