How to replicate 'Managed Service Accounts' AD group to other domain controller??

DisabledLivesMatter 141 Reputation points
2021-07-02T13:23:55.677+00:00

We have four (4) gMSAs in use for our SQL servers.

However, within ADUC on our two domain controllers, the four accounts appear within the 'Managed Service Accounts' group within only one of the two domain controllers, which is not good.

How do I replicate these gMSAs from one DC to the other??

I already tried forcing replication each way and the four gMSAs still do not appear in the one DC.

Help!! :) :)

Thank you, Tom

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
3,943 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Fan Fan 15,101 Reputation points
    2021-07-05T00:36:23.607+00:00

    Hi,

    If the gMSAs can't replicate to other DCs, you may try to run the following command and check if there are any errors in the output.

    Repadmin /syncall /APeD
    Repadmin /showrepl *
    repadmin /showrepl /all >c:\repadmin.txt

    Dcdiag /v >c:\dcdiag.log

    Best Regards,

  2. DisabledLivesMatter 141 Reputation points
    2021-07-12T13:04:54.647+00:00

    Running those commands shows no obvious issues, so I don't yet know what to do next. Thank you, Tom