Trying to leverage benefit of Group-Managed Service Accounts (gMSA) but have a mixed environment. My guide was this blog post: https://blogs.technet.microsoft.com/askpfeplat/2012/12/16/windows-server-2012-group-managed-service-accounts/
I've implemented as in the guide, tested on a Server 2012+ machine. BUT now I want to use same gMSA account to run the same service as above on a Windows 7 machine. Running this step that Win7 box:
results in Cannot Find an object with identity "gMSA-account-name". This remains true if I identify this account via GUID, SID, or full Distinguished Name path.
Searching WWW doesn't answer if I can use such an account on OS's earlier than Server 2012, i.e. Windows 7. I'd imagine if such a thing were possible, somehow extending the AD schema such that Win7 can understand this new type of account would be required (via ADMX files?)
Thanks for looking!