unable to create gmsa becuase KDS may not running of domain.

Question

I am trying to achieve the synchronization functionality between azure AD and on-premises AD. But i am getting this error "unable to create gmsa becuase KDS may not running of domain" While checking the logs no event ids are generated of 9001 and 9002 as community suggested for this solution(https://github.com/MicrosoftDocs/SupportArticles-docs/blob/main/support/azure/active-directory/azure-ad-hybrid-sync-unable-create-gmsa-kds-domain-controller.md

Answer 1

Hi @Khan_MK

Have you tried to continue with the troubleshooting guide besides the fact that you can't find the 9001 and 9002 events?

Based on the screenshot I can see that your server is set to support AES 128 and AES 256 encryption protocols (0x7ffffff8) There's a good chance that there's a mismatch between the Kerberos encryption protocol supported by the server and the ones supported by the account provAgentgMSA. Could you please follow the rest of the guidance and share the results? The link below from Microsoft Learn has some screenshots available for you:

https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/azure-ad-hybrid-sync-unable-create-gmsa-kds-domain-controller#unable-to-create-gmsa-because-kds-may-not-be-running-on-domain-controller

Answer 2

@Khan_MK ,

To add to Fabio's answer, sometimes the error you mentioned occurs when installing the agent for the first time. If you uninstall it, delete the gMSA from the domain, re-install the agent immediately, and reboot the server, you may be able to install the agent successfully again.  

Additionally, you may be able to resolve this by creating the KDS root key again with the command: Add-KdsRootKey -EffectiveTime ((get-date).addhours(-10))https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/create-the-key-distribution-services-kds-root-key

Answer 3

Hi @Khan_MK

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 4

Hi @Khan_MK

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.