We have RODC in a DMZ site and we would like to use GMSA, but the problem is that since domain controllers are read-only, it seems that I have to set a password at the creation of a new account such as:

New-ADServiceAccount -name STEST01_gmsa -DNSHostName STEST01_gmsa.mydomain.local -AccountPassword (ConvertTo-SecureString -AsPlainText "MyPassword" -Force) -Enabled $true -PrincipalsAllowedToRetrieveManagedPassword MyGROUP_TEST01_GMSA

The problem is that I've already a lot different ways and none of them worked. This last command returns the following error:

New-ADServiceAccount : Parameter set cannot be resolved using the specified named parameters. At line:1 char:1

  • New-ADServiceAccount -name STEST01_gmsa -PrincipalsAllowedToRetrieveM ...
  •   + CategoryInfo          : InvalidArgument: (:) [New-ADServiceAccount], ParameterBindingException
      + FullyQualifiedErrorId : 


Please help figure out what's missing here.

1 Answer 1


The "AccountPassword" attribute is ignored for gMSAs, it can be used for standard MSAs in scenarios like you describe where there is no writable access to a domain controller.

Quoting Microsoft docs: "In this case you should create the standalone MSA, link it with the appropriate computer account and assign a well-known password that needs to be passed when installing the standalone MSA on the server on the RODC-only site with no access to writable DCs."


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy