title: Error 5021 creating a "Managed Service Account"
body: <p>I have spent several days trying to get a "managed service account" set up on Windows Server 2012 for a .NET web app. Let's start with the error and work backwards.</p>
  
  <p>I get the following events ever time I try to access a page on the web site where * is the name of my app pool:</p>
  
  <ul>
  <li><strong>Warning 5021</strong> - The identity of application pool * is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request.  If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process Activation Service (WAS) can retry the logon. If the identity remains invalid after the first request for the application pool is processed, the application pool will be disabled. The data field contains the error number.</li>
  <li><strong>Warning 5057</strong> - Application pool * has been disabled. Windows Process Activation Service (WAS) did not create a worker process to serve the application pool because the application pool identity is invalid.</li>
  <li><strong>Error 5059</strong> - Application pool * has been disabled. Windows Process Activation Service (WAS) encountered a failure when it started a worker process to serve the application pool.</li>
  </ul>
  
  <p>~~~</p>
  
  <p>While standing up a new server, I came across what appears to be an awesome feature which I had not used before:</p>
  
  <ul>
  <li><a href="http://technet.microsoft.com/en-us/library/dd548356%28v=ws.10%29.aspx" rel="nofollow">http://technet.microsoft.com/en-us/library/dd548356%28v=ws.10%29.aspx</a></li>
  </ul>
  
  <p>Since I am standing up a new app with a new database, this seemed like the perfect opportunity to take this for a drive!</p>
  
  <p>I eventually figured out how to create the managed service account with the following power shell commands on a domain controller:</p>
  
  <ul>
  <li>import-module activedirectory</li>
  <li>new-ADServiceAccount -SAMACCOUNTname "<strong>SERVICE_ACCT$</strong>"</li>
  <li>add-adComputerServiceAccount -Identity <strong>SERVER_NAME</strong>  <strong>SERVICE_ACCT$</strong></li>
  </ul>
  
  <p>In the same powershell window, I can list services accounts for a given server with this powershell command:</p>
  
  <ul>
  <li>get-ADComputerServiceAccount <strong>SERVER_NAME</strong></li>
  </ul>
  
  <p>And my managed service account is there! All good so far ...</p>
  
  <p>I then had to modify our central group policy to include my service account for "Log on as batch job" and "Log on as service". These were under Polices\Windows Settings\Security Settings\Local Policies\User Rights Assignment on our domain controller (these were not editable on the local server as these were being pushed down).</p>
  
  <p>After the changes and a coffee break, the rights show up on my server!</p>
  
  <p>So now I have (1) created a managed service account which has (2) been granted access to a specific server and on that specific server (3) the service account has log on as batch job/service rights. I also (4) gave both the app pool and service account modify access to the web site folder.</p>
  
  <p>I verified the site works with the default AppPoolIdentity account.</p>
  
  <p>And ... I still get the errors above (which I have had during this whole process). I have to be missing something, but I just can find anything else to try!</p>
  
  <p>Regards,</p>
  
  <p>Cooter</p>