Skip to main content

New-XdrIdentityConfigurationRemediationActionAccount

SYNOPSIS​

Registers a new remediation action account for Microsoft Defender for Identity.

SYNTAX​

New-XdrIdentityConfigurationRemediationActionAccount [-AccountName] <String> [-DomainDnsName] <String>
 [-IsSingleLabelAccountDomainName] [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm]
 [<CommonParameters>]

DESCRIPTION​

Creates a new Group Managed Service Account (gMSA) registration for Microsoft Defender for Identity remediation actions. This account will be used by MDI to perform automatic remediation actions when the system is configured to use a dedicated account instead of Local System.

EXAMPLES​

EXAMPLE 1​

New-XdrIdentityConfigurationRemediationActionAccount -AccountName "MDIRemediation" -DomainDnsName "contoso.com"
Registers a gMSA account named "MDIRemediation" in the contoso.com domain for MDI remediation actions.

EXAMPLE 2​

New-XdrIdentityConfigurationRemediationActionAccount -AccountName "DefenderRemediator" -DomainDnsName "corp.contoso.com" -IsSingleLabelAccountDomainName
Registers a gMSA account with single-label domain name configuration.

PARAMETERS​

-AccountName​

The name of the Group Managed Service Account (without domain suffix).

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-DomainDnsName​

The fully qualified domain name (FQDN) where the account exists.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-IsSingleLabelAccountDomainName​

Switch parameter indicating if the domain is a single-label domain name. Use this for non-standard domain configurations.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf​

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm​

Prompts for confirmation before registering the account.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

Object​

Returns the registration response from the API including the account configuration details.​

NOTES​

  • The account must be a Group Managed Service Account (gMSA)
  • The account must already exist in Active Directory before registration
  • The MDI sensor must have permissions to retrieve the gMSA password
  • Before using this, ensure Set-XdrIdentityConfigurationRemediationActionAccount is configured to not use Local System