Question
You deploy a single-domain Active Directory Domain Services (AD DS) forest named contoso.com.
You deploy five servers to the domain. You add the servers to a group named ITFarmHosts.
You plan to configure a Network Load Balancing (NLB) cluster named NLBCluster.contoso.com that will contain the five servers.
You need to ensure that the NLB service on the nodes of the cluster can use a group managed service account (gMSA) to authenticate.
Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.
Explanation
Add-KdsRootKey creates the Key Distribution Services root key, which the domain controllers need before any group managed service account (gMSA) can be created. New-ADServiceAccount then creates the gMSA, with -PrincipalsAllowedToRetrieveManagedPassword set to the ITFarmHosts group so the five NLB nodes can retrieve its password. Finally, Install-ADServiceAccount is run on each node to install the gMSA locally so the NLB service can use it.
The servers are already in ITFarmHosts, so Add-ADGroupMember is not needed. Set-KdsConfiguration changes KDS algorithm settings and is not required, and Add-ADComputerServiceAccount links a standalone managed service account to one computer, which does not apply to a gMSA used by several servers.
