AEM on Windows needs a network share: test the service identity first

An AEM 6.5 team running author or publish as a Windows Service under Local System needs the application to read an external network share. Its Experience League question asks whether a group Managed Service Account is appropriate and what production risks the switch creates. The question has no verified AEM-specific answer yet.

Map every permission the current service uses

Record the Windows Service logon identity, AEM installation and repository paths, log directories, scheduled tasks, certificates, and remote endpoints. Local System's local privileges do not transfer automatically to a domain gMSA. A change made only to reach one share can stop startup, logging, or package installation if local permissions are omitted. Security and AEM operators should agree on the smallest required access.

Check the Windows account prerequisites

Microsoft's gMSA guidance covers the domain and host prerequisites, automatic password management, and use with services managed through the Windows Service Control Manager. Confirm that the AEM host can retrieve the account credentials, the service can log on with that identity, and both share and NTFS permissions allow only the required operations. A successful account setup does not itself prove AEM compatibility.

Rehearse startup and the actual file operation

Clone the service configuration in a representative nonproduction environment. Restart the service, verify AEM health, perform the exact share read or write, and check logs for access failures. Test a password rotation window and restart. Keep a documented rollback to the prior account and a secure plan for any files written under the old identity. Do not make the production identity change while the only evidence is that the share can be browsed interactively by an administrator.

Adovo’s view

An account switch is an application migration in miniature. The question is whether the entire AEM process can still operate with least privilege, not whether one folder opens. Prove the service path end to end before changing the production principal.