After having successfully created a Group Managed Service Account (gMSA) using the command below:

add-adserviceaccount -name gmsaAccount -PrincipalsAllowedToDelegateToAccount gmsaGroup -DNSHostName gmsaAccount.test.local

I am having trouble to have this account installed on the targeted hosts (members of gmsaGroup group). I wonder if the problem is not related to the hosts associated with the service account.

Is there a way (powershell command?) to verify which hosts are associated and authorized with a group managed service account.

I tried get-adserviceaccount -identity gmsaAccount | fl * but nothing related to hosts or principalsAllowedToDelegateToAccount is displayed.

For information, when i try to run the install-adserviceaccount on a target Windows2012R2 host, i get a useless "unknown error" message (no error code).

  1. Do you have at least one 2012 DC?
  2. Did you prep the domain with Add-KDSRootKey?
  3. After you added the computers to gmsaGroup, were they rebooted to get a new token that reflects the new group membership?
  4. When you create the account, I think you need to use "PrincipalsAllowedToRetrieveManagedPassword" instead of "PrincipalsAllowedToDelegateToAccount"

The cmdlet to create a new gMSA is "New-ADServiceAccount" not "Add-ADServiceAccount"

Process overview http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx

  • #4 is what tripped me up the first time I was messing around with gMSAs, mostly because I was tab-completing the argument and "Delegate" comes before "Retrieve" and didn't notice the difference. – Ryan Bolger Apr 28 '15 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.