Group Managed Service Accounts - Install-ADServiceAccount returns "Access Denied"

[Ross Wilper]

I am playing around with the Group Managed Service Accounts. I skipped MSA from Windows Server 2008 R2 since the single-computer limitation made it's value fairly low. Anyway, the 2012 RC documentation is still not really there and most is links to 2008R2 documents, so I may be doing this incorrectly.

Before Install-ADServiceAccount (on the local computer)

• I set up the KDS root key and it has replicated
• I ran New-ADServiceAccount and Add-ADComputerServiceAccount to create and assign a gMSA
• User account has FULL CONTROL of the gMSA object (even tried removing accidental deletion protection)

Looking through logs on the DCs, I see:

• Directory Access successes from the user account I am using - reading the gMSA object
• No Directory Access failures are recorded - auditing is on for all accesses to the gMSA object
• Privilege Use failures for the computer account to use seBackupPrivilege

There is nothing in logs on the local machine that I could find and the error message says WriteError: (<gMSA account>:String)

Continue reading...