Hi Ravikumar, I have seen both of these. Each is a monograph explaining creation of MSA. Neither explains how to investigate what I need. I can see my MSA in ADUC and if I enable advanced property view, then I can see lots of stuff. How do I find "NT Authority\Network Service" in a form that will let me compare it with my MSA?Thanks for the help, Chris.

Since "NT Authority\Network Service" is a built-in account, I've never seen any method to explore the permissions (or properties) on the local computer. Of course, it has permissions of the AD computer object elsewhere in the domain. The best resource I have seen is this article: http://msdn.microsoft.com/en-us/library/ms143504.aspx which explains the permissions that this and other built-in accounts have. Richard Mueller - MVP Directory Services

Hi Folks, How can I direct this question to the attention of Microsoft Contingent Staff? It has failed to find an answer in a number of different threads with several experienced people offering helpful, but ultimately, inadequate advice.Thanks for the help, Chris.

This is probably the best forum for your question, better than the PowerShell forum. Several Microsoft people contribute here and moderate. Richard Mueller - MVP Directory Services

Hi Chris, Thank you for your question. I am trying to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience. Thank you for your understanding and support. Best Regards, AidenAiden Cao TechNet Community Support

open secpol.msc on the server expand Local Policies\User Rights Assignment\ double click "Create Global Objects" policy, add the MSA. Then start the service with your MSA, please let me know the result. Hope it is helpful. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Arron, "Create Global Objects" is apparently not the missing privilege. Still fails to start.Thanks for the help, Chris.

Hi Folks, I have a Managed Service Account (MSA) on a Windows Server 2008r2 domain. The Fax Server fails to start when I specify this MSA as the log on account, but the Fax Server starts just find with "NT Authority\Network Service". Something is restricting my MSA account from Network Access -- Firewall, Group Policy, ADUC, ... Something. Logs show only ''A privilege that the service requires to function properly does not exist in the service account configuration." How can I determine where this restriction lives?Thanks for the help, Chris.

Please check if the MSA is allow to start as service. open secpol.msc on the server expand Local Policies\User Rights Assignment\ double click "log on as a service" policy, add the MSA. and try again. please let me know the result. if issue persists, please provide screenshots to show the error message and error code. Thanks. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hello, Check this article links once. http://www.petri.co.il/managed-service-accounts-1.htmhttp://technet.microsoft.com/en-us/library/dd548356.aspxRegards, Ravikumar P