Question
You have an Active Directory Domain Services (AD DS) domain that contains a group named Group1.
You need to create a group managed service account (gMSA) named Account1. The solution must ensure that Group1 can use Account1.
How should you complete the script? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
[Cmdlet] "Account" -DNSHostName "website.contoso.com" -[Parameter] "Group"
Explanation
Cmdlet: New-ADServiceAccount — This cmdlet creates a managed service account in AD DS; with -DNSHostName it creates a group managed service account. Install-ADServiceAccount only installs an existing gMSA on a host, Add-ADComputerServiceAccount links an existing service account to a computer object, and New-ADObject creates a generic object without the gMSA password management.
Parameter: -PrincipalsAllowedToRetrieveManagedPassword — A gMSA's password is managed by the domain controllers, and only the principals listed in this parameter can retrieve it and therefore run services as the account. Naming Group1 here lets its members use Account1. -PrincipalsAllowedToDelegateToAccount configures Kerberos resource-based constrained delegation to the account and does not allow anyone to use it, -AuthenticationPolicy assigns an authentication policy, and -Instance copies properties from an existing object.
