Is Install-ADServiceAccount on member servers necessary for gMSAs?

Question

In some of the documentation for gMSAs, it is shown that the PowerShell cmdlet Install-ADServiceAccount is a necessary step, but in practice, I've seen scenarios where this doesn't appear to be true. I've done the following in my lab to confirm:

1. Add a brand new server to the security group associated with a gMSA
2. Not run Install-ADServiceAccount on the new server
3. Run Test-ADServiceAccount on that server and it returns True
4. Assign this account to services, App Pools, Schedule Tasks, etc..

Does this mean that the account is good to use and working properly?

In this scenario, if there is an issue with the gMSA config due to not running Install-ADServiceAccount, is there a way to easily know that other than Test-ADServiceAccount?

Answer 1

Hello

Thank you for posting in Q&A forum.

Based on the description, you want to know test gmsa via Test-ADServiceAccount is true before you install gmsa via Install-ADServiceAccount, do you still need to install gmsa via Install-ADServiceAccount?

Based on my understanding,

Test-ADServiceAccount means checks readiness and proper delegation/permissions.

Install-ADServiceAccount means physically installs and registers the gMSA on the machine.

When you run Test-ADServiceAccount and get a True result, it means your computer is properly configured to retrieve and use that gMSA from Active Directory. However, Test-ADServiceAccount does not actually install the gMSA credentials locally—it only verifies that all prerequisites for using the gMSA are in place. In order for your services to actually use the gMSA, you still need to run Install-ADServiceAccount. It will install the necessary configuration on the local machine so that the operating system and services can authenticate using the gMSA.

Step-by-Step: How to work with Group Managed Service Accounts (gMSA)

https://techcommunity.microsoft.com/blog/itopstalkblog/step-by-step-how-to-work-with-group-managed-service-accounts-gmsa/329864

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.