Configure Panel Service for use with a GMSA

This article describes configuration of Panel Service, or Uplift (MIM Synchronization Service) for login to Identity Panel SaaS when using a Windows GMSA as the service account.

Install New Service

1. Follow the normal install step in Service Setup.exe. When prompted enter the login details of the GMSA, and make up a password (that will not be the correct password).
2. Create the application password and enter it normally.
3. When the install runs the service will fail to create or start, but all dlls and files will be prepared.
4. Run the following command to create the service with the builtin system account:
   sc create SoftwareIDM.PanelService binPath= "C:\Program Files\SoftwareIDM\PanelTools\SoftwareIDM.PanelService.exe" DisplayName= "SoftwareIDM Panel Service" start="auto"
5. Run the following script (adjust the account name) to switch to the GMSA

$serviceName = 'SoftwareIDM.PanelService'
$serviceObject = Get-WmiObject -Class Win32_Service -Filter "Name='$serviceName'"
$serviceObject.StopService() | out-null

# Change logon as settings
$serviceObject.Change($null, $null, $null, $null, $null, $null, 'DOMAIN\ACCOUNT$', $null, $null, $null, $null)
$ServiceObject.StartService()

Configure Login for Existing Service

This procedure may be used for any scenario where you are unable to run a command prompt as the service account being configured, in order to establish the login pairing.

1. Lookup the account name settings for the GMSA (server name, netBIOS Domain prefix, and sAMAccountName). For a GMSA the account name will end in a '$'.
      e.g. MIMSRV01, MYDOMAIN\svcMIMSync$
2. Open the Install Service page of Identity Panel
3. Fill in the server name, domain, and account
4. Create a new application password
5. Edit Panel Tools config.json (typically at C:\Program Files\SoftwareIDM\PanelTools\config.json), go to the “Auth” section, and edit or add a JSON field called “Password”. Set it to the value of the application password.
6. Restart the service that needs the login (if configuring Uplift for MIM Synchronization service, and restart FIM Sync Service and preview commit a user).
7. The service restart will encrypt the password and move it to the user logins section.