Getting Started

Overview

This guide walks through deploying the Britive Access Broker on a domain-joined Windows VM, configuring a Group Managed Service Account (gMSA) to run the broker service, delegating the minimum AD permissions required, and verifying the broker is connected to Britive.

Once complete, the broker is ready for all AD use cases covered in this section: group membership, admin account rotation, service account rotation, and AD scanning.

Before You Begin

A Britive tenant with administrator access
A domain-joined Windows Server 2019 or 2022 VM with outbound HTTPS (port 443) access
Domain Admin rights to create gMSAs and set AD delegations
A broker pool token from Resource Manager → Broker Pools → New Pool in the Britive console

Create the gMSA

A Group Managed Service Account (gMSA) removes the need to manage the broker’s service account password. The domain rotates it automatically.

1a. Ensure a KDS Root Key exists — run on a Domain Controller as Domain Admin:

# -10 hours backdates the key to make it active immediately (lab use only)
# For production, omit -EffectiveTime and wait 10 hours before using the key
Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10))

1b. Create the gMSA:

# Replace BROKERVM$ with your broker VM's computer account name
New-ADServiceAccount `
    -Name                                       "svc-britive" `
    -DNSHostName                                "svc-britive.contoso.com" `
    -PrincipalsAllowedToRetrieveManagedPassword "BROKERVM$" `
    -Description                                "Britive Access Broker service account"

If you plan to run multiple broker VMs in a pool, create a security group and grant that group retrieval rights instead of specifying individual computer accounts.

1c. Install the gMSA on the broker VM — run on the broker VM as a local administrator:

Install-ADServiceAccount -Identity "svc-britive"

# Verify
Test-ADServiceAccount -Identity "svc-britive"
# Should return: True

Install RSAT Active Directory Tools

The broker executes PowerShell scripts that use AD cmdlets. RSAT must be installed on the broker host.

# Windows Server
Install-WindowsFeature -Name "RSAT-AD-PowerShell"

# Windows 10/11
Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"

Confirm the module loads:

Get-Module -ListAvailable -Name ActiveDirectory

Delegate AD Permissions to the gMSA

Run the delegation script on a Domain Controller or a machine with RSAT. Adjust the OU DNs for your environment.

delegation.ps1

# ============================================================
# Britive gMSA — AD Delegation Script
# Run as Domain Admin
# ============================================================

$brokerAccount = "CONTOSO\svc-britive$"   # trailing $ = gMSA

# OU that contains the accounts the broker manages
$userOU  = "OU=ManagedAccounts,DC=contoso,DC=com"

# OU that contains the groups the broker manages
$groupOU = "OU=ManagedGroups,DC=contoso,DC=com"

# Create user objects (required for first-time -a account provisioning)
dsacls $userOU /I:T /G "$brokerAccount`:CC;user"

# Reset passwords
dsacls $userOU /I:S /G "$brokerAccount`:CA;Reset Password;user"

# Enable / disable accounts (writes userAccountControl)
dsacls $userOU /I:S /G "$brokerAccount`:WP;userAccountControl;user"

# Unlock accounts (writes lockoutTime)
dsacls $userOU /I:S /G "$brokerAccount`:WP;lockoutTime;user"

# Disable force-change-password at next logon (writes pwdLastSet)
dsacls $userOU /I:S /G "$brokerAccount`:WP;pwdLastSet;user"

# Add / remove group members
dsacls $groupOU /I:S /G "$brokerAccount`:WP;member;group"

Write-Host "Delegation complete."
Write-Host "Verify with: dsacls `"$userOU`""

Use case	Delegation required
AD scan	None — any domain user can read users and groups
Group membership	Write `member` on group OU
Admin account (`-a`) rotation	Write `member` + Create `user` + Reset Password + Enable/Disable
Service account rotation	Reset Password + Enable/Disable + Unlock + Disable force-PW-change

Grant Permissions on the Broker Install Directory

The broker downloads scripts to its install directory at runtime. The gMSA needs Full Control over this path.

$installDir = "C:\Program Files (x86)\Britive Inc\Britive Broker"
$acl = Get-Acl $installDir

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "CONTOSO\svc-britive$",
    "FullControl",
    "ContainerInherit,ObjectInherit",
    "None",
    "Allow"
)
$acl.AddAccessRule($rule)
Set-Acl -Path $installDir -AclObject $acl
Write-Host "Full Control granted to gMSA on broker install directory."

Install and Configure the Broker

Download the broker installer from your Britive tenant: Admin → Access Broker → Download Agent.

Run the installer on the broker VM. Default path:

C:\Program Files (x86)\Britive Inc\Britive Broker\

Open broker-config.yml in the install directory and set your broker pool token:
broker-config.yml
```
broker_pool_token: "<your-broker-pool-token>"
```
Configure the Windows service to run as the gMSA:
```
# No password is needed for gMSAs — leave it blank
sc.exe config "BritiveBroker" obj= "CONTOSO\svc-britive$"
```
Alternatively, use the Services console (services.msc): right-click Britive Broker → Properties → Log On → enter CONTOSO\svc-britive$ with a blank password.

Start the service:

Start-Service -Name "BritiveBroker"
Get-Service  -Name "BritiveBroker"
# Status should show: Running

Verify

In the Britive console, go to Resource Manager → Broker Pools and confirm the broker’s status shows Connected.

Check the broker logs for successful startup:

Get-EventLog -LogName Application -Source "BritiveBroker" -Newest 10

Troubleshoot

Symptom	Cause	Fix
Service fails to start with gMSA	Computer account not authorized	Add `BROKERVM$` to `PrincipalsAllowedToRetrieveManagedPassword`
`Test-ADServiceAccount` returns False	gMSA not installed on this host	Run `Install-ADServiceAccount -Identity svc-britive`
AD cmdlets fail: module not found	RSAT not installed	Run `Install-WindowsFeature RSAT-AD-PowerShell`
Broker shows Disconnected	Outbound HTTPS blocked	Confirm port 443 is open from the broker VM
Scripts fail with access denied	Delegation not applied or wrong OU	Re-run delegation script and verify with `dsacls`

Next Steps

Manage Group Memberships — JIT group membership checkout and checkin
Rotate Admin Accounts — JIT credential rotation for -a accounts
Rotate Service Accounts — Service account and Windows service credential rotation
Scan Active Directory — Sync AD users and groups into Britive Resource Manager

Last updated on July 3, 2026

Manage Group Memberships