Credential overview

Group Managed Service Account

To support Group Managed Service Accounts (gMSAs) the DSC resource must support it. This also applies to Managed Service Accounts (MSAs).

There are more information about using (g)MSAs with SQL Server in the article Configure Windows Service Accounts and Permissions in section Managed Service Accounts, Group Managed Service Accounts, and Virtual Accounts

To use a (g)MSA with a DSC resource you should pass the (g)MSA account name in the credential object and use any text string as password.

It is not possible to pass $null as password, it is a limitation by how the MOF is generated when encrypting passwords.

If there is a resource that you find that will not work with a (g)MSAs then please submit a new issue. Then the community can work together to support (g)MSAs for that DSC resource too.

For designing a resource for (g)MSAs see the section Group Managed Service Account in the contribution guidelines.

^{This was discussed in issue #738.}

Built-In Account

To use a built-in account with a DSC resource you should pass the built-in account name, e.g. 'NT AUTHORITY\NetworkService' in the credential object and use any text string as password.

It is not possible to pass $null as password, it is a limitation by how the MOF is generated when encrypting passwords.

If there is a resource that you find that will not work with a built-in account then please submit a new issue. Then the community can work together to support built-in accounts for that DSC resource too.