gmsa account parent / child domain

Question

I have a managed service account already created in Child domain(abc.xyz.local) and its working as expected. I am also able to retrieve KDS key in child domain using “Get-KDSrootkey” command.

However in Parent domain “xyz.local”, I cant find any key when running “Get-KDSrootkey”.
I am concerned if I need to create new Key in parent domain first before creating gmsa account in parent domain ?

Also is it going to impact existing gmsa account in child domain ?

Answer 1

Hi,
Not sure the process you created the GMSA.
If you try to use a gMSA too soon the key might not have been replicated to all domain controllers and therefore password retrieval might fail when the gMSA host attempts to retrieve the password. gMSA password retrieval failures can also occur when using DCs with limited replication schedules or if there is a replication issue.

I would recommend you recreate the KDSrootkey.
The Key Distribution Service (KDC) should be restarted on all domain controllers if the root key is recreated.
For your reference:
https://learn.microsoft.com/en-us/powershell/module/kds/add-kdsrootkey?view=win10-ps
https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/create-the-key-distribution-services-kds-root-key

Best Regards,

Answer 2

You'll need a KDS root key object in every domain where you create a GMSA. It won't hurt anything to create one in the other domain.