기본적으로 위임된 관리자 계정은 setupadmin입니다. 도메인을 만든 후에는 사용자 이름을 변경할 수 없습니다. 도메인을 만들 때만 커스텀 사용자 이름을 지정할 수 있습니다. 커스텀 사용자 이름을 지정하는 경우 SAM-Account-Name 속성의 이름 지정 규칙을 따라야 합니다.
기본적으로 위임된 관리자 계정의 비밀번호는 42일 후에 만료됩니다. 비밀번호가 만료되기 전에 변경해야 합니다.
세밀화된 비밀번호 정책 개념(FGPP)을 사용하여 위임된 관리자 계정의 비밀번호 만료를 사용 중지할 수 있습니다. FGPP를 사용하면 필요한 비밀번호 설정 객체(PSO)의 Maximum password age 정책 설정 값을 '0'으로 설정하고 위임된 관리자 계정에 비밀번호 정책을 적용할 수 있습니다.
위임된 관리자 계정의 비밀번호 만료를 사용 중지하려면 Cloud Service Fine Grained Password Policy Administrators 그룹의 구성원이어야 합니다.
이 그룹에 사용자를 추가하려면 PowerShell에서 다음 명령어를 실행하세요.
Add-ADGroupMember -Identity 'Cloud Service Fine Grained Password Policy Administrators'
-Members USER
USER를 Cloud Service Fine Grained Password Policy Administrators 그룹에 추가할 사용자의 이름으로 바꿉니다.
DELEGATED_ADMINISTRATOR_ACCOUNT: 비밀번호 만료를 사용 중지하려는 위임된 관리자 계정의 이름. 예를 들면 setupadmin입니다.
Add-ADFineGrainedPasswordPolicySubject cmdlet에 대한 자세한 내용은 비밀번호 정책에 사용자 또는 그룹 추가를 참고하세요.
Active Directory Domain Services 도구 사용
AD DS(Active Directory 도메인 서비스) 도구에 액세스하려면 위임된 관리자 계정을 사용해야 합니다. VM 인스턴스에 연결하면 위임된 관리자 계정으로 로그인해야 합니다. VM에 연결한 후 계정을 전환하거나 추가 사용자 인증 정보를 제공할 수 없습니다. VM에 연결한 후 역할 및 기능 추가 마법사를 사용하여 AD DS 도구를 사용 설정할 수 있습니다. AD DS 도구 사용에 대해 자세히 알아보세요.
UPN 서픽스 만들기
현재 도메인과 루트 도메인의 이름은 기본 사용자 기본 이름(UPN) 서픽스입니다. 대체 도메인 이름을 추가하면 보안이 강화되고 사용자 로그인 이름이 간단해집니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[],[],null,["# Use delegated administrator account\n\nThis page shows you how to use the delegated administrator account and manage its credentials in Managed Service for Microsoft Active Directory.\n\nOverview\n--------\n\nWhen you create a Managed Microsoft AD domain, Managed Microsoft AD automatically creates a delegated administrator account. You can use this account to manage the domain.\nAfter you log into this account, you can perform the following tasks:\n\n- Manage data and Active Directory objects.\n- Manage other service administrators.\n- Use standard Active Directory tools.\n\nLearn more about\n[the rights that are automatically granted to the delegated administrator account](/managed-microsoft-ad/docs/objects#delegated_administrator).\n| **Note:** The Domain and Enterprise administrator accounts of Managed Microsoft AD domains are reserved for use by Google Cloud.\n\nGet account name\n----------------\n\nBy default, the delegated administrator account is named `setupadmin`. After domain\ncreation, you can't change the username. You can specify a custom username only when you\n[create a domain](/managed-microsoft-ad/docs/create-domain). If you specify a custom username, make sure that you follow the naming conventions of\n[SAM-Account-Name\nattribute](https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccountname).\n\nTo retrieve the name of the delegated administrator account, complete the following steps: \n\n### Console\n\n1. In the Google Cloud console, go to the [**Managed Microsoft AD**](https://console.cloud.google.com/security/cloud-ad) page. \n [Go to Managed Microsoft AD](https://console.cloud.google.com/security/cloud-ad)\n2. Under **FQDN**, select the domain to get the delegated administrator account name for.\n3. The account name is listed under **Admin name**.\n\n### gcloud\n\nRun the following command: \n\n```\ngcloud active-directory domains describe DOMAIN_NAME\n```\n\nThe response is YAML containing information about the domain. The delegated\nadministrator account name is listed under the `managedIdentitiesAdminName`\nfield: \n\n managedIdentitiesAdminName: setupadmin\n\nReset the password\n------------------\n\nIf you forget the password for the delegated administrator account, you can't retrieve the existing password. However, you can\nreset the password.\n\nTo reset the delegated administrator account's password, you must have any one of the following IAM roles:\n\n- Google Cloud Managed Identities Admin (`roles/managedidentities.admin`)\n- Google Cloud Managed Identities Domain Admin (`roles/managedidentities.domainAdmin`)\n\nFor more information, see\n[Cloud Managed Identities roles](/iam/docs/understanding-roles#cloud-managed-identities-roles).\n**Warning:** Resetting the password returns a new password in human-readable, plain-text form. Ensure that your screen is secure before you run the command and click **Confirm**. \n\n### Console\n\n1. In the Google Cloud console, go to the [**Managed Microsoft AD**](https://console.cloud.google.com/security/cloud-ad) page.\n\n\n [Go to Managed Microsoft AD](https://console.cloud.google.com/security/cloud-ad)\n\n2. Under **FQDN**, select the domain to reset the delegated administrator\n password for.\n\n3. On the **Domain details** page, select the **Set Password**.\n\n4. In the **Set password** dialog, click **Confirm**.\n\n5. The new password is displayed in the **New password** dialog.\n\n### gcloud\n\nRun the following command: \n\n```\ngcloud active-directory domains reset-admin-password DOMAIN_NAME\n```\n\nThis operation can take up to 60 seconds to complete.\n\nDisable password expiration\n---------------------------\n\nBy default, the password for the delegated administrator account expires after\n42 days. Make sure that you change the password before it expires.\n\nYou can use [fine-grained password policies (FGPP)](/managed-microsoft-ad/docs/fgpp-concepts) to disable password expiration for the delegated administrator account. Using FGPP, you can set the value of `Maximum password age` policy setting in the required password settings objects (PSO) to \"0\" and enforce the password policy on the delegated administrator account.\n\nTo disable password expiration for your delegated administrator account, you must be a member of the `Cloud Service Fine Grained Password Policy Administrators` group.\n\n1. To add a user to this group, run the following command in PowerShell:\n\n ```\n Add-ADGroupMember -Identity 'Cloud Service Fine Grained Password Policy Administrators' \n\n -Members USER\n ```\n Replace \u003cvar translate=\"no\"\u003eUSER\u003c/var\u003e with the name of the user which you want to add to `Cloud Service Fine Grained Password Policy Administrators` group.\n\n \u003cbr /\u003e\n\n For more information, see [Delegate permissions to manage policies](/managed-microsoft-ad/docs/how-to-use-fgpp#delegate-permissions).\n2. Log off from the delegated administrator account.\n\n | **Note:** If you add `setupadmin` to the `Cloud Service Fine Grained Password Policy Administrators` group, you have to restart the VM instead of logging off from the account.\n\nTo disable password expiration for your delegated administrator account, do the following:\n\n1. Login as a member of the `Cloud Service Fine Grained Password Policy Administrators` group.\n\n2. To modify the value of `MaxPasswordAge` property to \"0\", run the following command in PowerShell:\n\n ```\n Set-ADFineGrainedPasswordPolicy -Identity PSO -MaxPasswordAge 0\n ```\n Replace \u003cvar translate=\"no\"\u003ePSO\u003c/var\u003e with the name of the PSO in which you want to disable the password expiration policy using FGPP. For example, `PSO-10`.\n\n \u003cbr /\u003e\n\n For more information about `Set-ADFineGrainedPasswordPolicy` cmdlet, see [Modify a pre-created password policy](/managed-microsoft-ad/docs/how-to-use-fgpp#modify-password-policy).\n3. To apply the password policy to your delegated administrator account, run the following command in PowerShell:\n\n ```\n Add-ADFineGrainedPasswordPolicySubject PSO -Subjects DELEGATED_ADMINISTRATOR_ACCOUNT\n ```\n Replace the following:\n\n \u003cbr /\u003e\n\n - \u003cvar translate=\"no\"\u003ePSO\u003c/var\u003e: Name of the PSO in which you have disabled the password expiration policy. For example, `PSO-10`.\n - \u003cvar translate=\"no\"\u003eDELEGATED_ADMINISTRATOR_ACCOUNT\u003c/var\u003e: Name of the delegated administrator account for which you want to disable password expiration. For example, `setupadmin`.\n\n For more information about `Add-ADFineGrainedPasswordPolicySubject` cmdlet, see [Add a user or group to a password policy](/managed-microsoft-ad/docs/how-to-use-fgpp#add-to-password-policy).\n\nUsing Active Directory Domain Services tools\n--------------------------------------------\n\nTo access Active Directory Domain Services (AD DS) tools, you must use the\ndelegated administrator account. When you\n[connect to the VM instance](/compute/docs/instances/connecting-to-windows),\nbe sure to log in with the delegated administrator account. You cannot switch\naccounts after connecting to the VM or provide additional credentials. After\nconnecting to the VM, you can use the [Add Roles and Features Wizard](https://docs.microsoft.com/en-us/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#install-roles-role-services-and-features-by-using-the-add-roles-and-features-wizard) to enable the AD DS tools. Learn more about\n[enabling AD DS tools](/managed-microsoft-ad/docs/connect-to-active-directory-domain).\n\nCreate a UPN suffix\n-------------------\n\nThe names of the current domain and the root domain are the default user\nprincipal name (UPN) suffixes. Adding alternative domain names provides\nadditional security and simplifies user login names.\n\nTo create a UPN suffix, complete the following steps:\n\n1. [Connect to the VM instance](/compute/docs/instances/connecting-to-windows) with the delegated administrator account.\n2. Open **Server Manager**.\n3. From **Tools** , select **Active Directory Domains and Trusts**.\n4. In the **Active Directory Domains and Trusts** management console, right-click **Active Directory Domains and Trusts** in the left pane, and then select **Properties**.\n5. In the dialog box, in the **Alternate UPN suffixes** box, type the name of the new UPN suffix.\n6. Click **Add** , and then click **OK**.\n\nWhen you add a new user account to Active Directory, you should see the\nnew UPN suffix available in the list when setting the username."]]
