After having successfully created a Group Managed Service Account (gMSA) using the command below:
add-adserviceaccount -name gmsaAccount -PrincipalsAllowedToDelegateToAccount gmsaGroup -DNSHostName gmsaAccount.test.local
I am having trouble to have this account installed on the targeted hosts (members of gmsaGroup group). I wonder if the problem is not related to the hosts associated with the service account.
Is there a way (powershell command?) to verify which hosts are associated and authorized with a group managed service account.
get-adserviceaccount -identity gmsaAccount | fl * but nothing related to hosts or
principalsAllowedToDelegateToAccount is displayed.
For information, when i try to run the
install-adserviceaccount on a target Windows2012R2 host, i get a useless "unknown error" message (no error code).