PowerShell Automation, Part 1: Create a Group Managed Service Account (gMSA)

Automation is becoming an increasingly important part of my day-to-day work, and AI tools continue to make it easier to get started. But getting a script to run is only the beginning; how it runs and what it can access are just as important.

In this multipart automation series, I’ll walk you through a practical approach to running PowerShell scripts with dedicated identities and carefully scoped access. The overall goal is to build an automation script that runs daily to carry out tasks in your environment, such as exporting Intune data and uploading it to another resource, or pausing Windows updates for update rings in Intune.

In Part 1, we’ll lay the foundation by creating a group Managed Service Account (gMSA) to run PowerShell scripts through Windows Task Scheduler. Let’s get started.

The PowerShell Automation Series

• Part 1: Create a Group Managed Service Account (gMSA)
• Part 2: Create a Microsoft Entra ID App Registration
• Part 3: Set Up Certificate-Based Authentication
• Part 4: Schedule Your Script with Windows Task Scheduler

Getting Started

There are several ways to automate PowerShell scripts, but two common approaches are:

1. Azure Automation runbooks — If you’re already using Azure in your environment, or your endpoints are fully cloud-joined, this may be a suitable option. There may be additional costs, so check current Azure Automation pricing for your expected usage.
2. Windows Task Scheduler on a server — If you already have the infrastructure in place and are still using Active Directory, whether your endpoints are hybrid-joined or cloud-only, this may be a cost-effective option. This is what I’ll use in the examples throughout these guides, although many of the concepts also apply to Azure Automation runbooks.

In Part 1 of this walkthrough, I’ll show you how to create and configure a group Managed Service Account (gMSA) in Active Directory, then install and test it on your automation server. This account will provide the identity for running PowerShell scripts through Task Scheduler on your automation server. As the series progresses, we’ll build on this foundation to run automation tasks in Microsoft cloud services such as Intune, Entra ID, and SharePoint using Microsoft Graph.

Before You Begin

This guide assumes you plan to use Windows Task Scheduler on a domain-joined server to schedule your automations. If you’ve decided to take a different route, such as Azure Automation runbooks, you can skip to Part 2 of this series. If you don’t manage Active Directory in your environment, pass these instructions along to your Active Directory administrators so they can create the gMSA.

Before creating the gMSA, have your Active Directory administrators confirm that the domain and forest functional levels support gMSAs and that a usable KDS root key is in place. If a new key is required, allow for replication and Microsoft’s documented waiting period before continuing.

Let’s Get Started

1. Check the Active Directory PowerShell Module

First, confirm that the Active Directory PowerShell module is installed. In Windows PowerShell on a server or management host with the appropriate administrative access, run:

PowerShell

Get-Module ActiveDirectory -ListAvailable

Select text to copy.

View fullsize

If the module is not available on Windows Server, install it by running the following command in an elevated Windows PowerShell session:

PowerShell

Install-WindowsFeature RSAT-AD-PowerShell

Select text to copy.

2. Create the gMSA

Next, create the automation account using the PowerShell command below.

Update the following parameters to match your environment:

• -Name — The name of the service account.
• -DNSHostName — Your Active Directory DNS domain name. This example uses contoso.com.
• -PrincipalsAllowedToRetrieveManagedPassword — The server’s computer account that will use this service account to run the automation.

PowerShell

New-ADServiceAccount `
    -Name "gmsaAutomation" `
    -DNSHostName "contoso.com" `
    -Description "Automation gMSA for scheduled tasks and PowerShell automation on the Contoso Automation Server" `
    -PrincipalsAllowedToRetrieveManagedPassword 'contososerver$'

Select text to copy.

You can then confirm that the account was created by running:

PowerShell

Get-ADServiceAccount -Identity gmsaAutomation

Select text to copy.

View fullsize

3. Install and Test the gMSA on the Automation Server

On the server that will run your automations, follow the previous steps if needed to ensure the Active Directory PowerShell module is available.

Install the gMSA on the automation server by running the following command in an elevated Windows PowerShell session:

PowerShell

Install-ADServiceAccount -Identity gmsaAutomation

Select text to copy.

Then verify that the server can use the gMSA by running:

PowerShell

Test-ADServiceAccount -Identity gmsaAutomation

Select text to copy.

The command should return True.

View fullsize

4. Grant the “Log on as a batch job” Right

The gMSA needs permission to run scheduled tasks on the automation server. To grant it, open secpol.msc on the automation server, then:

1. Go to Local Policies → User Rights Assignment → Log on as a batch job.
2. Add the gmsaAutomation account, using your domain-qualified account name, such as CONTOSO\gmsaAutomation$. If you have difficulty finding it, select Advanced, include service accounts in the object types where available, and make sure you are searching the correct domain. Then search for and select your gMSA.

View fullsize

View fullsize

This setting may also be controlled by Group Policy. If so, update the applicable Group Policy setting instead. If it applies only to this automation server and is not controlled by Group Policy, granting the right locally is generally appropriate. There is no need to grant this gMSA access to every server.

5. Configure Access to the Logs Folder

Ensure that the gMSA also has the NTFS permissions needed to write to the logs folder. All of my scripts use the following location by default:

📁Folder path

C:\AutomationScripts\Logs

Select text to copy.

What’s Next

Now that the gMSA automation account is created and configured, we have the foundation in place to run automated PowerShell scripts on our server.

In future blog posts, we’ll focus on configuring the rest of our environment to support these automations by creating a Microsoft Entra ID app registration and a certificate, then setting up the automation in Windows Task Scheduler.