Creating Kerberos Identity for RD Session Host Farms Part II: using a WMI Script
Published Sep 07 2018 06:46 PM 891 Views
First published on CloudBlogs on May, 27 2009

Part I of this blog post series describes the benefits of using a Kerberos Identity for Remote Desktop Session Host (Terminal Server) farms and provides information on how to create and manage this Kerberos Identity using Remote Desktop Services provider for Windows PowerShell.

You can achieve finer control over the farm account in Active Directory by using the Win32_SessionBrokerFarmAccount WMI class. This class allows you to set or change account’s password, change the password update rules, set or change the DNS name associated with the account, or disassociate the account from the farm without deleting it from Active Directory.

The Win32_SessionBrokerFarmAccount class is defined as following:

Win32_SessionBrokerFarmAccount Class

Provides properties for creating, deleting, viewing and modifying the properties of a farm account in Remote Desktop Connection Broker (RD Connection Broker).

[dynamic, provider("Win32_WIN32_SESSIONBROKERFARMACCOUNT_Prov)]

class Win32_SessionBrokerFarmAccount


[key, read]

string FarmName;

[read, write]

boolean Manual;

[read, write]

string AccountName;

[read, write]

string AccountDomain;


string AccountPassword;


string AccountSPN1;


string AccountSPN2;


string ComputerDNSName;


uint32 DeleteEx( [In] boolean DeleteComputerObject );



The Win32_SessionBrokerFarmAccount class defines the following methods.


Deletes a farm account. Unlike SWbemObject.Delete_ method this method provides an option of not deleting the farm account from Active Directory (SWbemObject.Delete_ always deletes the account from Active Directory).


The Win32_SessionBrokerFarmAccount class defines the following properties.


Data type: string
Access type: Read-only
Qualifiers: Key

Name of the farm in RD Connection Broker.


Data type: boolean
Access type: Read and write

Determines whether or not farm account’s password is managed automatically by the RD Connection Broker. If this value is set to true Connection Broker will not be updating the account’s password. It is strongly recommended to set this value to false , in order to allow Connection Broker to periodically update the farm account’s password.


Data type: string
Access type: Read and write

User name of the farm account.


Data type: string
Access type: Read and write

Domain name of the farm account.


Data type: string
Access type: Write-only

Password of the farm account.


Data type: string
Access type: Read-only

First SPN associated with the farm account. This SPN corresponds to the account’s NetBIOS name.


Data type: string
Access type: Read-only

Second SPN associated with the farm account. This SPN corresponds to the account’s FQDN.


Data type: string
Access type: Write-only

DNS name to be associated with the farm account.


Win32_SessionBrokerFarmAccount supports SWbemObject methos: Delete_ and Put_ . Use SWbemObject.Put_ method to create a new farm account or modify an existing one.

Sample JScript code

To run this sample, in the code below replace ”MyFarm”, “MyFarmAccount” and “” with the appropriate farm, farm account and domain names, place the code into a “FarmAccount.js” file, start cmd.exe as administrator on the Connection Broker and then run the following command:

“cscript FarmAccount.js”.

Important! To be able to run this script successfully you need to be a domain user having “Add workstations to domain” user right and a member of Administrators group on the Connection Broker. The script must run locally on the Session Broker. Win32_SessionBrokerFarmAccount does not support calls from remote clients.

Important! Kerberos identity is not supported if the Connection Broker runs as a node in a Failover Cluster.

var WbemAuthenticationLevelPktPrivacy = 6;

var Locator = new ActiveXObject("WbemScripting.SWbemLocator");

var strComputer = ".";

var strNamespace = "rootCIMV2";

Locator.Security_.AuthenticationLevel = WbemAuthenticationLevelPktPrivacy;

var Service = Locator.ConnectServer (strComputer, strNamespace);


// Creating a new farm account


Object = Service.Get("Win32_SessionBrokerFarmAccount.FarmName="MyFarm"");

WScript.Echo ("Service.Get: OK");

Object.AccountName = "MyFarmAccount";

Object.AccountDomain = "";

Object.Manual = false;

var ObjectPath = Object.Put_(2);


// Enumerating existing farm accounts


var objSet = Service.InstancesOf("Win32_SessionBrokerFarmAccount");

WScript.Echo ("objSet.Count : " + objSet.Count );

var Objects = new Enumerator (objSet);

var Object;

for(; !Objects.atEnd(); Objects.moveNext() )


Object = Objects.item();

WScript.Echo ("Object.FarmName : " + Object.FarmName );

WScript.Echo ("Object.AccountName : " + Object.AccountName );

WScript.Echo ("Object.AccountDomain : " + Object.AccountDomain );

WScript.Echo ("Object.AccountSPN1 : " + Object.AccountSPN1 );

WScript.Echo ("Object.AccountSPN2 : " + Object.AccountSPN2 );

WScript.Echo ("Object.Manual : " + Object.Manual );

WScript.Echo ("Object.AccountPassword : " + Object.AccountPassword );

WScript.Echo ("Object.ComputerDNSName : " + Object.ComputerDNSName );

WScript.Echo ("==========");


Version history
Last update:
‎Sep 07 2018 06:46 PM