Looking for recommendations on the above, I want to use gMSA accounts in as many places as I can that support them as it makes management easier not having to deal with password changes however I ran into a snag with using it in IIS for an AppPool, in the scenario I am linking a UNC path to a virtual directory and that UNC path happens to be a DFS namespace. Now the default permissions on the file system don't allow access to a DFS namespace and I'm not really sure why as Users have Domain Users and Authenticated Users so I figured gMSA would be considered an Authenticated User but I guess it isn't, I can however add the gMSA to Domain Users or Users and everything works fine. Is there a recommended direction when using a gMSA in this fashion? Should I add the gMSA to the servers that it would be accessing for example to the file server? Is it common practice to add gMSA accounts to Domain Users so they have access to other network resources? I know Microsoft's recommendation is to use a gMSA if supported where you would use a Domain User for network access but a Domain Users by default belongs to Domain Users that is added to Users giving access to the local machine if using default permissions.
Thanks
