We have RODC in a DMZ site and we would like to use GMSA, but the problem is that since domain controllers are read-only, it seems that I have to set a password at the creation of a new account such as:
New-ADServiceAccount -name STEST01_gmsa -DNSHostName STEST01_gmsa.mydomain.local -AccountPassword (ConvertTo-SecureString -AsPlainText "MyPassword" -Force) -Enabled $true -PrincipalsAllowedToRetrieveManagedPassword MyGROUP_TEST01_GMSA
The problem is that I've already a lot different ways and none of them worked. This last command returns the following error:
New-ADServiceAccount : Parameter set cannot be resolved using the specified named parameters. At line:1 char:1
- New-ADServiceAccount -name STEST01_gmsa -PrincipalsAllowedToRetrieveM ...
+ CategoryInfo : InvalidArgument: (:) [New-ADServiceAccount], ParameterBindingException + FullyQualifiedErrorId :
Please help figure out what's missing here.