Does anyone else experience outages when gMSA passwords are rotated?
When our gMSA accounts are automatically rotated, we see login failures for around 1-10 minutes. This is particularly apparent for gMSA client accounts that connect to MS SQL server, but I think it happens for other gMSA account...
we do have a substantial fleet of services but we could change that
We're also looking at how to mass migrate people off TopShelf and Framework 4.8 to something that's dotnet core and maybe 5, maybe just 3.1, but away from TS
So if we did that and changed the way we handle our kerb due to TS or something, that's all groovy. I don't think that TS has any bearing here, but it could since I don't know
Maybe we tell everyone to go drop "windows.system.security.refreshkerb.after(30s)" or something when they refactor off TS?
it's more domain wide, but we will need to figure to which DC the server, where the fail happen, authentificate against, versus where the account got changed.
I seen such error in other way, like an user X that change is password in a complex AD, and it took him like 30m before he can log on in his Exchange OWA, because the Exchange server auth to a remote DC
Replication between domain controllers could be an issue, but I'm not seeing any authentication failures on DC's which leads me to believe that it's more related to the token than the password