如何通过 C# 创建 GMSA 帐户

Question

I have tried to look for the c# code example to see how the AD service account is created but not much luck. Anyone can provide an example code for creating AD service account please?

I have tried UserPrincipal with $ at the end of the name but not much luck. Errors with Access Denied (Cant create under root MyDomain or under a CN)

// Domain Context to use specific LDAP path.
domainContext = new PrincipalContext(ContextType.Domain, domainContext.ConnectedServer, "CN=Managed Service Accounts,dc=mydomain");
UserPrincipal userAccount = new UserPrincipal(domainContext)
{
  DisplayName = userName,
  SamAccountName = $"{userName}$",
  Description = description
};
userAccount.Save();

Answer 1

Little late, but I think I can answer it. You need to use the NetAddServiceAccount function through logoncli.dll. I hadn't been able to get it to work in PowerShell, even with adding what I thought was an appropriate type shim, but I just came across a module that seems to work.

https://github.com/beatcracker/Powershell-Misc/blob/master/Use-ServiceAccount.ps1

The C# code for the type definition in that script should have everything you need to implement it for yourself.