> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/ad-identities/dmsas.md).

# DMSAs

The `DMSAs` page provides a list of enumerated delegated managed service accounts in entire Acitve Directory. The list contains the `Enabled`, `Privileged`, `Admin`, `Local Admin`, `Session`, `Risk Score` `Exposure Point` and `Issue Counts`.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-8705744df773873b5a1dbb14feeb5ddd0e592ff3%2Fad-identities-dmsas-image-1.png?alt=media" alt=""><figcaption><p>Delegated Managed Service Accounts</p></figcaption></figure>

### Delegated Managed Service Account Details

Details page contains the `Risk Score` of the delegated managed service account, `Exposure Point`, `Information`, and `Issues` panes.

{% hint style="info" %}
You can analyze objects in the `Graph module` by clicking the `Visualize` button on the upper left side of the `Information Pane`.
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-8921a21d5153293bbdc4838c1467b5ac32e1e820%2Fdmsa-detail2.png?alt=media" alt="Delegated Managed Service Account Details"><figcaption><p>Delegated Managed Service Account Details</p></figcaption></figure>

### Information

`Information Pane` can contain different badges to highlight important attributes.

| Badge           | Description                                                                                                        |
| --------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Sensitive**   | Indicates that the object is marked as not delegated or a member of the Protected Users group.                     |
| **Privileged**  | Indicates that the object is Privileged.                                                                           |
| **Admin**       | Indicates that the object is Admin.                                                                                |
| **Local Admin** | Indicates that the object is a member (direct or nested) of a local administrators group in at least one computer. |
| **Enabled**     | Indicates that the object is enabled.                                                                              |
| **Disabled**    | Indicates that the object is disabled.                                                                             |

`Information Pane` contains `Details`, `Groups`, `Sessions`, `SPNs`, and `Local Memberships` tabs respectively.

### Details

Details tab contains attributes below about delegated managed service account object.

| Attribute                    | Description                                                                                                                                                                                                             |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **SAM AccountName**          | The logon name used to support clients and servers running earlier versions of the operating system, such as Windows NT 4.0, Windows 95, Windows 98, and LAN Manager. (**Ldap Display Name**: sAMAccountName)           |
| **Distinguished Name**       | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName)                                                                                                                           |
| **Object Category**          | An object class name used to group objects of this or derived classes. (**Ldap Display Name**: objectCategory)                                                                                                          |
| **Object Sid**               | Active Directory security identifier of object. (**Ldap Display Name**: objectSid)                                                                                                                                      |
| **Created Time**             | The date when this object was created. (**Ldap Display Name**: whenCreated)                                                                                                                                             |
| **Last Changed Time**        | The date when this object was last changed. (**Ldap Display Name**: whenChanged)                                                                                                                                        |
| **Parent OU**                | The direct parent Organizational Unit of the object.                                                                                                                                                                    |
| **Name**                     | Name of the specified object. (**Ldap Display Name**: name)                                                                                                                                                             |
| **Bad Password Count**       | The number of times the user tried to log on to the account using an incorrect password. (**Ldap Display Name**: badPwdCount)                                                                                           |
| **Primary Group ID**         | Contains the relative identifier (RID) for the primary group of the object. By default, this is the RID for the Domain Computers group for group managed service accounts.                                              |
| **Admin Count**              | Indicates that a given object has had its ACLs changed to a more secure value by the system because it was a member of one of the administrative groups (directly or transitively). (**Ldap Display Name**: adminCount) |
| **Logon Count**              | The number of times the account has successfully logged on. This attribute is not replicated to other Domain Controllers. (**Ldap Display Name**: logonCount)                                                           |
| **Constrained Delegation**   | Indicates whether the Constrained Delegation is active or not.                                                                                                                                                          |
| **Preceded Managed Account** | It is the original service account before being delegated to dMSA.                                                                                                                                                      |

### Groups

Groups tab contains a list of groups that the delegated managed service account is a member of. This list also contains `Privileged` and `Admin` columns to identify the privilege levels of these groups.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-cb143b2af57218d6c67367e551f783abf9fe93d1%2Fdmsa-groups.png?alt=media" alt="Groups"><figcaption><p>Groups</p></figcaption></figure>

### Sessions

Sessions tab contains a list of computers that the delegated managed service account has a session on. This list also contains `IP Address`, and `Privileged` columns to identify the network address and privilege levels of these computers.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-e78c82415fd83835fcdb1685cbdaaa892050b788%2Fdmsa-sessions.png?alt=media" alt="Sessions"><figcaption><p>Sessions</p></figcaption></figure>

### SPNs

SPNs tab contains a list of `Service Principal Names` that are defined on the delegated managed service account object.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-6198b513ab273d186b943b95125bcf94cbbcbb64%2Fdmsa-spns.png?alt=media" alt="SPNs"><figcaption><p>SPNs</p></figcaption></figure>

### Local Memberships <a href="#local-memberships" id="local-memberships"></a>

Local Memberships tab contains a list of local groups that the delegated managed service account is a member of.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-8ca7a3fb3e6927b42cb6563af0c357d3b1d1c8af%2Fdmsa-local-memberships.jpg?alt=media" alt="Local Memberships"><figcaption><p>Local Memberships</p></figcaption></figure>

**Local Group Name**: Name of the local group that the user is a member of.

**Computer**: Name of the computer object that contains the local group.

**Exec DCOM**: Indicates whether the local group can have enough privilege to execute commands with DCOM(Distributed Component Object Model) protocol on the computer.

**Exec PWSH**: Indicates whether the local group can have enough privilege to execute commands with Powershell on the computer.

**RDP**: Indicates whether the local group can have enough privilege to connect with RDP (Remote Desktop Protocol) to the computer.

**Admin**: Indicates whether the local group can have admin privilege on the computer.

### Issues

Issues pane contains identified issues on the delegated managed service account object.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-27c779356e93df9de8ebd49e943973809f659238%2Fdmsa-issues.png?alt=media" alt="Issues"><figcaption><p>Issues</p></figcaption></figure>