Running BMC Discovery Outpost under a gMSA account

This section describes the procedure for running the BMC Discovery Outpost under a Group Managed Service Account (gMSA) in Active Directory.

The following table describes the tasks that you must perform in the specified sequence, the description of the action that you must perform, and the reference to the procedure:

Before you begin 

Before you configure your system for running the BMC Discovery Outpost under a gMSA account, make sure that the following requirements are completed:

• Your domain environment must fulfill the operating system and Active Directory Domain Service requirements, as listed in the  Microsoft documentation .
• You must have Administrator access to the domain, or have the appropriate permissions as described in the Microsoft documentation.
• You must have a machine on which to install the BMC Discovery Outpost – the BMC Discovery Outposthost.

To create a KDS root key for your domain 

1. At an elevated PowerShell prompt on a domain controller, run the following command:
   
   

   Get-KdsRootKey

   If the result shows that you already have a KDS root key, skip step 2.
   
   

2. Run the following PowerShell command to create the root key. 

   Add-KdsRootKey -EffectiveImmediately

   Note

   After running the command to create the root key, you need to wait for ten hours before continuing.

To create a domain security group for the BMC Discovery Outpost host 

1. At an elevated PowerShell prompt on a domain controller, run the following command. Ensure that you modify the path as relevant to your domain:

   New-ADGroup "BMC Discovery Outpost" -GroupCategory Security -GroupScope Global -Path "DC=mydomain,DC=com"

2. Run the following command to add your BMC Discovery Outpost host to this security group. Ensure that you substitute OUTPOSTSERVER with your actual BMC Discovery Outpost host name:

   Add-AdGroupMember -Identity "BMC Discovery Outpost" -Members OUTPOSTSERVER$

To create the gMSA 

• At an elevated PowerShell prompt on a domain controller, run the following command. Ensure that you replace mydomain with the actual name of your domain:

  New-ADServiceAccount -Name "bmc-disco-outpost" -DnsHostName "bmc-disco-outpost.mydomain.com"  -PrincipalsAllowedToRetrieveManagedPassword "BMC Discovery Outpost"

  Note

  In the command to create the gMSA, "BMC Discovery Outpost" must match the name of the security group that you created in the earlier procedure.

To install the gMSA on the BMC Discovery Outpost host 

1. Reboot the BMC Discovery Outpost host to ensure that it is up-to-date with the group membership.

2. At an elevated PowerShell prompt on the BMC Discovery Outpost host, run the following command:

   Install-AdServiceAccount "bmc-disco-outpost"

   Note

   You may need to install the Active Directory PowerShell module to run the command.

To add the gMSA to the local administrators' group on the BMC Discovery Outpost host 

• At an elevated PowerShell prompt on the BMC Discovery Outpost host, run the following command. Ensure to replace mydomain with the name of your domain:

  Add-LocalGroupMember -Group "Administrators" -Member "mydomain\bmc-disco-outpost$"

  
  

(Optional) To install the BMC Discovery Outpost 

If you have the BMC Discovery Outpost already installed on the BMC Discovery Outpost host, skip to the next section. Otherwise, you can download the installer for the BMC Discovery Outpost from the Manage > Outposts option and install the BMC Discovery Outpost using the steps in Installing the BMC Discovery Outpost.

To configure the BMC Discovery Outpost to run as the gMSA account 

Perform the following steps when you already have a BMC Discovery Outpost running:

1. Go to Start > Settings > Control Panel > System and Security.
2. Click Administrative Tools and then double-click Services.
3. Right-click the BMC Discovery Outpost Service entry in the Services list and click Properties.
4. In the Log On tab, do the following:
   1. Set the This account name as mydomain\bmc-disco-outpost$ where you replace mydomain with your actual domain name.
   2. Leave the password fields blank.
      
      
      
      
5. Click Apply and then OK to save the settings.
6. Restart the BMC Discovery Outpost so that it runs as the new account.

To grant permissions to the gMSA account to discover hosts in the domain 

The gMSA account must have the appropriate permissions to allow the BMC Discovery Outpost access to the hosts in the domain that it is scanning. This can be done by either adding the gMSA account to an appropriate domain administrators' group or by adding the gMSA account to the local administrators' group on each machine individually.

It should now be possible to scan Windows hosts in the domain.