Question
You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.
You deploy a server to the domain and configure the server to run a service.
You need to ensure that the service can use a group managed service account (gMSA) to authenticate.
Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.
Explanation
1. Add-KdsRootKey: gMSA passwords are generated by the Key Distribution Service, so the domain needs a KDS root key before you can create any gMSA. In production, allow up to 10 hours for the key to replicate. 2. New-ADServiceAccount: creates the gMSA in contoso.com. Use -PrincipalsAllowedToRetrieveManagedPassword to name the server (or a group that contains it) that may retrieve the password. 3. Install-ADServiceAccount: run this on the server to install the gMSA locally, so the service can be configured to run as the account. Add-ADComputerServiceAccount, Set-KdsConfiguration and Add-ADGroupMember are not required in this sequence.
