Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows 2012 R2 domain controller called I have set up a group of hosts where I would like to use a gMSA (Group Managed Service Account). This group is called SQLManagedHosts.

I created the account by following these steps in Powershell on the domain controller:

PS C:\Windows\system32> Add-KdsRootKey -EffectiveTime ((get-date).addhours(-10))


PS C:\Windows\system32> New-ADServiceAccount mSQL -DNSHostName -PrincipalsAllowedToRetrieveManagedPassword SQLManagedHosts

PS C:\Windows\system32> Get-ADServiceAccount msql

DistinguishedName : CN=mSQL,CN=Managed Service Accounts,DC=win,DC=testlab
Enabled           : True
Name              : mSQL
ObjectClass       : msDS-GroupManagedServiceAccount
ObjectGUID        : cf9df74a-38e0-4d7a-856e-9af882b08800
SamAccountName    : mSQL$
SID               : S-1-5-21-3443997112-87545443-1733229669-1602
UserPrincipalName :

On one of the hosts listed in SQLManagedHosts, I ran:

PS C:\Windows\system32> Install-ADServiceAccount msql
Install-ADServiceAccount : Cannot install service account. Error Message: 'An unspecified error has occurred'.
At line:1 char:1
+ Install-ADServiceAccount msql
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : WriteError: (mSQL:String) [Install-ADServiceAccount], ADException
    + FullyQualifiedErrorId : InstallADServiceAccount:PerformOperation:InstallServiceAcccountFailure,Microsoft.ActiveDirectory.Management.Commands.InstallADServiceAccount

Any ideas why it might be failing? All servers involved are Windows Server 2012 R2.

share|improve this question
up vote 2 down vote accepted

You cannot use gMSA for SQL services, it's unsupported. You must instead use MSA.


share|improve this answer
Yes I know that but I would like to try with various different services. Any ideas why it won't install? – Mark Allison Jun 6 '14 at 20:44
I see. Sorry then, I cannot help you there. – Daniel Jun 9 '14 at 10:12
I also tried with the SQLWmi interface with powershell using the SetServiceAccount() method but I got this error: Exception calling "SetServiceAccount" with "2" argument(s): "Set service account failed. " – Mark Allison Jun 16 '14 at 14:35

I'm not sure why it could be failing but when I was messing the gMSAs and SQL I was using this GUI and it worked fine.


share|improve this answer

If you have only recently created the SQLManagedHosts security group and added your computer objects to it, you will have to restart the server for group membership to take effect. Since the server is not a member of the security group if you don't, retrieving the managed password will fail.

You will need to keep this in mind when planning security groups for group MSAs.

share|improve this answer

I now this is an old posting but I figured I would still mention it. Watch this video.

I think you may have missed some steps. Hope it helps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.