IIS 应用程序池不会在组托管服务帐户下启动

Question

我正在尝试在同一活动目录 Group Managed Service Account 下运行 Windows 服务和 IIS 网站SomeServiceAccount。

我有 2 台服务器App和Web. 我创建了一个名为 的组SomeGroup，添加App并Web使用命令 Add-ADGroupMember "SomeGroup" -Members (Get-ADComputer "App")和Add-ADGroupMember "SomeGroup" -Members (Get-ADComputer "Web")

重新启动两台机器以确保它们是组的一部分

在域控制器上运行命令 New-ADServiceAccount -Name SomeServiceAccount -Enabled $true -DNSHostName domain-controller -PrincipalsAllowedToRetrieveManagedPassword "SomeGroup"

去了两台机器并跑了 Set-AdServiceAccount SomeServiceAccount

App使用用户SOMEDOMAIN\SomeServiceAccount$和无密码在机器上启动 Windows 服务，然后启动正常

去Web机器，分配应用程序池标识如上。点击网站，应用程序池停止。

在事件日志中有一个错误： Application pool SomePool has been disabled. Windows Process Activation Service (WAS) encountered a failure when it started a worker process to serve the application pool.

和它旁边的两个警告

Application pool SomePool has been disabled. Windows Process Activation Service (WAS) did not create a worker process to serve the application pool because the application pool identity is invalid.

和

The identity of application pool SomePool is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request. If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process Activation Service (WAS) can retry the logon. If the identity remains invalid after the first request for the application pool is processed, the application pool will be disabled. The data field contains the error number.

该服务运行但网站 503s 并在我访问该网站时停止应用程序池。我已更改站点的权限以允许服务帐户访问它。

有人有任何想法吗？我真的很想能够使用 GMSA 而不是普通的域帐户来运行它

Answer 1

确保您已将服务帐户添加到运行应用程序池的服务器上的“允许批量登录”设置的用户中？

https://www.brooksnet.com/faq/granting-logon-as-batch-privilege

（以管理员身份运行 secpol.msc 并将帐户添加到“本地策略\用户权限分配\作为批处理作业登录”）