> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/ad-identities/dmsas.md).

# DMSAs

Open **Unified Identities › Non Human Identities**, filter **Providers** to **Active Directory › Delegated Managed Service Account**, then select a row to open its details.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-11ab4fcdf6d2f5053514a1eff2fa02afd16f6995%2Fad-identities-dmsas-image-1.png?alt=media" alt=""><figcaption><p>Delegated Managed Service Accounts</p></figcaption></figure>

## Delegated Managed Service Account Details

Opening a delegated managed service account shows the `Risk` and `Exposure Point` in its header, and the `Information` and `Issues` panes. The `Issues` pane is shown only when the object has issues.

{% hint style="info" %}
You can analyze the object in the [Graph](/forestall/visualize/visualize.md) by clicking the **Graph »** button next to the `Information` title. For a shadow admin the button reads **Admin Path »** and opens the shortest path to admin objects (see [Object Detail Pages](/forestall/unified-identities.md#object-detail-pages)).
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-8921a21d5153293bbdc4838c1467b5ac32e1e820%2Fdmsa-detail2.png?alt=media" alt="Delegated Managed Service Account Details"><figcaption><p>Delegated Managed Service Account Details</p></figcaption></figure>

## Information

`Information Pane` can contain different badges to highlight important attributes.

| Badge               | Description                                                                                                        |
| ------------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Shadow**          | Indicates that the object can compromise admin objects with at least one attack path.                              |
| **Sensitive**       | Indicates that the object is marked as not delegated or a member of the Protected Users group.                     |
| **Privileged**      | Indicates that the object is Privileged.                                                                           |
| **Admin**           | Indicates that the object is Admin.                                                                                |
| **Local Admin**     | Indicates that the object is a member (direct or nested) of a local administrators group in at least one computer. |
| **Inactive**        | Indicates that the enabled object has not logged on within the inactivity threshold of the scan policy.            |
| **Enabled**         | Indicates that the object is enabled.                                                                              |
| **Disabled**        | Indicates that the object is disabled.                                                                             |
| **Tier0**/**Tier2** | Indicates the tier of the object (`Tier0` or `Tier2`).                                                             |

`Information Pane` contains `Details`, `Groups`, `Sessions`, `SPNs`, and `Local Memberships` tabs respectively.

## Details

Details tab contains attributes below about delegated managed service account object.

| Attribute                    | Description                                                                                                                                                                                                             |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **SAM AccountName**          | The logon name used to support clients and servers running earlier versions of the operating system, such as Windows NT 4.0, Windows 95, Windows 98, and LAN Manager. (**Ldap Display Name**: sAMAccountName)           |
| **Distinguished Name**       | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName)                                                                                                                           |
| **Object Category**          | An object class name used to group objects of this or derived classes. (**Ldap Display Name**: objectCategory)                                                                                                          |
| **Object Sid**               | Active Directory security identifier of object. (**Ldap Display Name**: objectSid)                                                                                                                                      |
| **Created Time**             | The date when this object was created. (**Ldap Display Name**: whenCreated)                                                                                                                                             |
| **Last Changed Time**        | The date when this object was last changed. (**Ldap Display Name**: whenChanged)                                                                                                                                        |
| **Parent OU**                | The direct parent Organizational Unit of the object.                                                                                                                                                                    |
| **Name**                     | Name of the specified object. (**Ldap Display Name**: name)                                                                                                                                                             |
| **Bad Password Count**       | The number of times the user tried to log on to the account using an incorrect password. (**Ldap Display Name**: badPwdCount)                                                                                           |
| **Primary Group ID**         | Contains the relative identifier (RID) for the primary group of the object. By default, this is the RID for the Domain Computers group for delegated managed service accounts.                                          |
| **Admin Count**              | Indicates that a given object has had its ACLs changed to a more secure value by the system because it was a member of one of the administrative groups (directly or transitively). (**Ldap Display Name**: adminCount) |
| **Logon Count**              | The number of times the account has successfully logged on. This attribute is not replicated to other Domain Controllers. (**Ldap Display Name**: logonCount)                                                           |
| **Constrained Delegation**   | Indicates whether the Constrained Delegation is active or not.                                                                                                                                                          |
| **Preceded Managed Account** | The original service account that this dMSA supersedes; links to that account. (**Ldap Display Name**: msDS-ManagedAccountPrecededByLink)                                                                               |
| **Email**                    | E-mail address of the object. (**Ldap Display Name**: mail)                                                                                                                                                             |
| **Common Name**              | Common name of the object. (**Ldap Display Name**: cn)                                                                                                                                                                  |
| **DNS Host Name**            | Name of the account as registered in DNS. (**Ldap Display Name**: dNSHostName)                                                                                                                                          |
| **AltSecurityIdentities**    | Alternative identities, such as certificate subjects or issuers, that can be used to authenticate as this account. (**Ldap Display Name**: altSecurityIdentities)                                                       |

## Groups

Groups tab contains a list of groups that the delegated managed service account is a member of. This list also contains `Privileged` and `Admin` columns to identify the privilege levels of these groups.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-cb143b2af57218d6c67367e551f783abf9fe93d1%2Fdmsa-groups.png?alt=media" alt="Groups"><figcaption><p>Groups</p></figcaption></figure>

## Sessions

Sessions tab contains a list of computers that the delegated managed service account has a session on. This list also contains `IP Address`, and `Privileged` columns to identify the network address and privilege levels of these computers.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-48576c6b1e52483e2adc759d097e5779adcd029c%2Fdmsa-sessions.png?alt=media" alt="Sessions"><figcaption><p>Sessions</p></figcaption></figure>

## SPNs

SPNs tab contains a list of `Service Principal Names` that are defined on the delegated managed service account object.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-6198b513ab273d186b943b95125bcf94cbbcbb64%2Fdmsa-spns.png?alt=media" alt="SPNs"><figcaption><p>SPNs</p></figcaption></figure>

## Local Memberships

Local Memberships tab contains a list of local groups that the delegated managed service account is a member of.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-7aa29e276d401868c2a98b0383655149d83858bd%2Fdmsa-local-memberships.png?alt=media" alt="Local Memberships"><figcaption><p>Local Memberships</p></figcaption></figure>

**Local Group Name**: Name of the local group that the user is a member of.

**Computer**: Name of the computer object that contains the local group.

**Exec DCOM**: Indicates whether the local group can have enough privilege to execute commands with DCOM(Distributed Component Object Model) protocol on the computer.

**Exec PWSH**: Indicates whether the local group can have enough privilege to execute commands with Powershell on the computer.

**RDP**: Indicates whether the local group can have enough privilege to connect with RDP (Remote Desktop Protocol) to the computer.

**Admin**: Indicates whether the local group can have admin privilege on the computer.

## Issues

Issues pane contains identified issues on the delegated managed service account object.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-27c779356e93df9de8ebd49e943973809f659238%2Fdmsa-issues.png?alt=media" alt="Issues"><figcaption><p>Issues</p></figcaption></figure>