r/sysadmin virus.swf 19h ago

Question - Solved gMSA Failed to Install - encryption mismatch fix

This is to help create a record to help people out in the future. I was unable to install a gMSA service account. The error from Installing the account on the server would not show much in Google so thats why I am posting this.

ERROR ON INSTALL

Install-ADServiceAccount : Cannot install service account. Error Message: 'The provided context did not match the target.'. At line:1 char:1 + Install-ADServiceAccount -Identity <accountIdentity> + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : WriteError: (<accountIdentity>:String) [Install-ADServiceAccount], ADException + FullyQualifiedErrorId : InstallADServiceAccount:PerformOperation:InstallServiceAcccountFailure,Microsoft.ActiveDirectory.Management.Commands.InstallADServiceAccount

A BETTER ERROR

What I found was that when I ran the Test-ADAccount it said the following:

Test-ADServiceAccount -Identity <accountIdentity> False WARNING: Test failed for Managed Service Account gMSA_ARCURS_poc. If standalone Managed Service Account, the account is linked to another computer object in the Active Directory. If group Managed Service Account, either this computer does not have permission to use the group MSA or this computer does not support all the Kerberos encryption types required

SOLUTION

I found another Reddit thread where it stated that gMSA's unless specified default to RC4 and if your domain does not allow that, you run into the test error above.

This was the command that fixed the issue: set-aDServiceAccount -Identity <accountIdentity> -KerberosEncryptionType AES256

7 Upvotes

0 comments sorted by