Implementing gMSA Accounts in SQL Sentry for Enhanced Security

5/29/2024 2:44 PM

5/26/2026 10:37 PM

SQL Sentry is a powerful tool for monitoring and managing SQL Server databases. It offers two installation methods: the Unified Installation (a graphical user interface) and the Enhanced Platform Installer (EPI), which uses command-line instructions. When setting up SQL Sentry, administrators may prefer to use Group Managed Service Accounts (gMSA) for improved security and simplified account management.

The Unified Installation method does not support the use of gMSA accounts during the initial setup. Instead, administrators must first install SQL Sentry using a non-gMSA account. After the installation is complete and the monitoring service is operational, administrators can then change the service account to a gMSA using the SQL Sentry Service Configuration Utility on the server hosting the Monitoring Service. This change should not be attempted through the Windows Control Panel.

On the other hand, the EPI method allows for the use of gMSA accounts during the initial installation process. To enable gMSA support in SQL Sentry when using EPI, administrators must first enable a feature flag within the SQL Sentry database. This involves executing a specific SQL command to turn on the GmsaSupport feature flag. Once this flag is enabled, the installation commands can include the --isGmsa flag to configure the monitoring and controller services to run under a gMSA account.

By following these steps, administrators can effectively manage their SQL Sentry installations using gMSA accounts, ensuring enhanced security and streamlined account management.

SQL Sentry (SQLS)

To configure SQL Sentry to use gMSA accounts, follow these steps based on your chosen installation method:

Unified Installation Method (GUI):

1. Initial Installation:

   • Perform the initial installation of SQL Sentry using a non-gMSA account.
   • Complete the setup and ensure the monitoring service is functioning correctly.

2. Changing to gMSA:

   • Open the SQL Sentry Service Configuration Utility on the server that hosts the Monitoring Service.
   • Update the service account to the desired gMSA account within the utility. (The service account will appear with a $ after it in the Service Configuration message and service screen to denote that it is a gMSA account.)
   • Avoid using the Windows Control Panel for this change, as it is not supported.

Enhanced Platform Installer (EPI) Method (Command Line):

1. Enable gMSA Support:

   • Connect to the SQL Sentry database.
   • Execute the following SQL command to enable the GmsaSupport feature flag

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

INSERT INTO Setup.FeatureFlag VALUES ('GmsaSupport', 1);

          2. Installation with gMSA:

• Use the following command template to install SQL Sentry with gMSA support

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

so install --IAcceptLicenseTerms -n <connectionName> -u <username> --isGmsa

Example of using the isGmsa flag with the monitoring service installation command:
 

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

so installms --IAcceptLicenseTerms -n <connectionName> -s <monitoringServiceServer> -u <serviceAccount> --isGmsa

Note:  When a service account is running under gMSA it will appear with a dollar sign at the end of the Log On As account name.



By following these instructions, administrators can successfully configure SQL Sentry to use gMSA accounts, leveraging their benefits for enhanced security and easier management.