Add-ADComputerServiceAccount

Add one or more service accounts to an AD computer.

Syntax
      Add-ADComputerServiceAccount [-Identity] ADComputer [-ServiceAccount] ADServiceAccount[]
        [-AuthType {Negotiate | Basic}] [-Credential PSCredential] [-Partition string]
           [-PassThru] [-Server string] [-Confirm] [-WhatIf] [CommonParameters]

key
   -AuthType ADAuthType
       The authentication method to use:
          Negotiate or 0
          Basic or 1
       A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.

   -Credential PSCredential
       A user account that has permission to perform this action.
       The default is the current user unless the cmdlet is run from an AD PowerShell provider drive
       in which case the account associated with the drive is the default.

       "User64" or "Domain01\User64" or a PSCredential object.

   -Identity ADComputer
       An AD computer object:

          Distinguished Name
             Example: CN=PC1234,CN=Europe,CN=Users,DC=SS64,DC=com
          GUID  (objectGUID)
             Example: 579c4d2e-f62d-4d20-8a88-030d97495f10
          Security Identifier (objectSid)
             Example: S-1-5-21-3164297828-301567370-526410523-1153
          Security Accounts Manager Account Name (sAMAccountName)
             Example: PC1234

       The identifier in parentheses is the LDAP display name for the attribute.

       The cmdlet searches the default naming context or partition to find the object.
       If the identifier given is a DN, the partition to search will be computed from that DN.
       If two or more objects are found, the cmdlet returns a non-terminating error.

       This parameter can also accept an object through the pipeline.
 
   -Partition string
       The distinguished name of an AD partition.
       The distinguished name must be one of the naming contexts on the current directory server.
       The cmdlet searches this partition to find the object defined by the -Identity parameter.
       examples:
          -Partition "CN=Configuration,DC=EUROPE,DC=TEST,DC=SS64,DC=COM"

          -Partition "CN=Schema,CN=Configuration,DC=EUROPE,DC=TEST,DC=SS64,DC=COM"

       In many cases, a default value will be used for -Partition if no value is specified.

   -PassThru
       Returns the new or modified object.
       By default (i.e. if -PassThru is not specified), this cmdlet does not generate any output.

   -Server DomainName\ComputerName
       The domain controller that will add the computer to the domain.
       Default = the local computer.

    -ServiceAccount ADServiceAccount[]
        One or more AD service accounts. 
        Identify a service account by using one of the following property values:
          Distinguished Name
            Example: CN=serviceadmin,CN=Europe,CN=Users,DC=corp,DC=SS64,DC=com
          GUID (objectGUID)
            Example: 599c3d2e-f72d-4d20-8a88-030d99495f20
          Security Identifier (objectSid) 
            Example: S-1-5-21-3165297888-301567370-576410423-1103
          SAM Account Name (sAMAccountName)
            Example: serviceadmin

        The following example shows how to specify a service account for this parameter using the SAM Account Name.
          -ServiceAccount "serviceAdminEurope"

   -whatIf
       Describe the command results without actually executing it.

   -confirm
       Prompt for confirmation before executing the command.

   CommonParameters:
       -Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction, -WarningVariable,
       -OutBuffer -OutVariable.

Add-ADComputerServiceAccount adds one or more service accounts to an AD computer.

MSA’s can run one (or more) services on one specific computer.

Create the MSA in AD. (New-ADServiceAccount)
Associate the MSA with a computer in AD. (Add-ADComputerServiceAccount)
Install the MSA on the computer that was associated. (Install-ADServiceAccount)
Configure the service(s) to use the MSA.

The -Computer parameter specifies the AD computer that will host the new service accounts. Identify a computer by its distinguished name (DN), GUID, security identifier (SID) or Security Accounts Manager (SAM) account name. You can also set the -Computer parameter to a computer object variable, or pass a computer object through the PowerShell pipeline, for example, from Get-ADComputer.

The -ServiceAccount parameter specifies the service accounts to add. You can identify a service account by its distinguished name (DN), GUID, Security Identifier (SID) or Security Accounts Manager (SAM) account name. You can also specify service account object variables. To specify more than one account, use a comma-separated list.

Examples

Add the service account '_Service01' to the Computer Account 'pc64':

PS C:\> Add-ADComputerServiceAccount -Computer pc64 -serviceAccount _Service01

Add the two service accounts '_Service01,_Service02' to the Computer Account 'pc64':

PS C:\> Add-ADComputerServiceAccount -Computer pc64 -serviceAccount _Service01,_Service02

“Room service? Send up a larger room” ~ Groucho Marx

Related PowerShell Cmdlets:

Get-ADComputerServiceAccount - Get the service accounts that are hosted by an AD computer.
Remove-ADComputerServiceAccount - Remove one or more service accounts from a computer.