I’m a big fan of Managed Service Accounts because they are much more secure and aren’t easily exploited by human beings. Basically, Active Directory controls the account with it being responsible for changing passwords. While use of gMSA (group managed service accounts) is sometimes hit or miss, I didn’t find much on recent use with Citrix other than a vague “we support this” statement.
Carl Webster had a much older attempt with PVS (not sure whether he tried again or not) and I wanted to ensure that this worked on PVS 7.7 (just released).
You’ll need a couple of things
I would leverage a tool for creating and managing gMSA that I got here.
(note: for a quick guide on setting this up, I would look through Derek Seaman’s blog).
Add you PVS server to the list otherwise it won’t work. (I only have 1 PVS server right now, I’m in rebuilding mode…)
For SOAP, you’ll need to make this account a member of the local admins on the PVS server (when you add the account, make sure you select “service accounts” for objects.
For SQL, I am using 2014 with availability groups. Check out Derek’s blog for a great walkthrough on this.
Your database should have been created already (use the dbscript.exe to manually create the database in PVS)
Grant the permissions needed to your gMSA on the SQL database (I create the account on both database servers just in case (when I test the failover))
Testing failover should work and you will also notice the services are running
magicalyak 