Export keys fails using gMSA

gomski 21 Reputation points
2021-03-01T11:42:39.85+00:00

Hello, I am about to install MIM Synchronization Service on a Windows 2012R2 system. I used SP2 if MIM2016 to install it and updated it to the lates hotfix release 4.6.359.0. I used the available descriptions to install the sync service using a gMSA account.
The service runs OK and I can access everything as expected with the service manager.
But one thing is just not working out - exporting the encryption keys via miiskmu.exe.
I started it via 'run as admin' and started miiskmu.exe via administrative command line: miiskmu.exe /e c:\configBU\exp3.bin /u:"mydomain\SVC-MIMSync$" The output is as follows: 

Installing assembly 'C:\Program Files\Microsoft Forefront Identity Manager\2010\ Synchronization Service\Bin\Microsoft.IdentityManagement.KeyProtectService.exe'. Affected parameters are: assemblypath = C:\Program Files\Microsoft Forefront Identity Manager\2010\Syn chronization Service\Bin\Microsoft.IdentityManagement.KeyProtectService.exe logfile = C:\Program Files\Microsoft Forefront Identity Manager\2010\Synchron ization Service\Bin\Microsoft.IdentityManagement.KeyProtectService.InstallLog Installing service MIMKeyProtectService...  
Creating EventLog source MIMKeyProtectService in log Application...

The contents of the installLog ends at the same line 'Creating EventLog source MIMKeyProtectService in log Application...'.
The same works without a problem when using a standard account instead of a gMSA account.
For any reason the spun up application is not able to create an event log source when running with a gMSA account.
Can someone give me a hint what I am missing? Thanks a lot!

73749-mim-gmsa-miiskmu-error.jpg

Microsoft Identity Manager
Microsoft Identity Manager
A family of Microsoft products that manage a user's digital identity using identity synchronization, certificate management, and user provisioning.
607 questions
0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Leo Erlandsson 1,656 Reputation points
    2021-03-04T07:03:31.267+00:00
    0 comments
  2. gomski 21 Reputation points
    2021-03-04T08:07:39.253+00:00

    Yes - the screenshot is from using the GUI. And yes I used 'run as admin'.

    0 comments
  3. gomski 21 Reputation points
    2021-03-04T22:56:29.457+00:00

    Another question comes into my mind. What is the impact of this tool and the encryption keys anyways. I have changed the MIM Sync Service Account now for serval times from local to domain and gMSA users, but I was still able to start the service and my management agents without any problems so far. It is only miiskmu which is not working when using a domain account as a service account. Miiskmu is working when using a local account as service account.
    To be more specific about the environment I am using. It is just the sync service I am using, no Sharepoint, MIM Service or anything else is running.

    0 comments
  4. gomski 21 Reputation points
    2021-05-13T15:28:41.757+00:00

    Problem has been solved after installing everything on a new and clean installed machine.