This topic shows how to use the Managed Service for Microsoft Active Directory delegated administrator account and manage its credentials.
When you create a Managed Service for Microsoft Active Directory domain, a delegated administrator account is automatically created for you. You can use this account to manage the domain. When you are logged into this account, you can:
- Manage data and Active Directory objects
- Manage other service administrators
- Use standard Active Directory tools
Learn more about about the rights that are automatically granted to the delegated administrator account.
Getting the account name
By default, the delegated administrator account is named
setupadmin. You can
also specify a custom username when
creating a domain. After
domain creation, the username cannot be changed.
To retrieve the name of the delegated administrator account:
Run the following command:
gcloud active-directory domains describe domain-name
The response is YAML containing information about the domain. The delegated
administrator account name is listed under the
Resetting the password
If you forget the password for the delegated administrator account, you can reset it. There is no method for retrieving an existing password.
To reset the delegated administrator password, a user must be granted the
IAM role, or another role granting the
managedidentities.domains.resetpassword permission. See
Granting, changing, and revoking access
to learn more.
Under FQDN, select the domain to reset the delegated administrator password for.
On the Domain details page, select the Set Password.
In the Set password dialog, click Confirm.
The new password is displayed in the New password dialog.
Run the following command:
gcloud active-directory domains reset-admin-password domain-name
This operation can take up to 60 seconds to complete, since it resets the password inside the domain itself.
Disabling password expiration
By default, the password for the delegated administrator account expires after 42 days.
To disable password expiration for the account, you can use the
PowerShell cmdlet with the
Learn more about the
Using Active Directory Domain Services Tools
To access Active Directory Domain Services (AD DS) tools, you must use the delegated administrator account. When you connect to the VM instance, be sure to log in with the delegated administrator account. You cannot switch accounts after connecting to the VM or provide additional credentials. After connecting to the VM, you can use the Add Roles and Features Wizard to enable the AD DS tools. Learn more about enabling AD DS tools.
Creating a UPN suffix
The names of the current domain and the root domain are the default user principal name (UPN) suffixes. Adding alternative domain names provides additional security and simplifies user login names.
To create a UPN suffix:
- Connect to the VM instance with the delegated administrator account.
- Open Server Manager.
- From Tools, select Active Directory Domains and Trusts.
- In the Active Directory Domains and Trusts management console, right-click Active Directory Domains and Trusts in the left pane, and then select Properties.
- In the dialog box, in the Alternate UPN suffixes box, type the name of the new UPN suffix.
- Click Add, and then click OK.
When you add a new user account to Active Directory, you should see the new UPN suffix available in the list when setting the username.