I have had Group Managed Service Accounts running before in our AD without a problem. The one server that ran all the policies needed to be updated so it was imaged and everything was wiped. When I now go to install the account (Install-ADServiceAccount gMSA-AD.Modify) powershell hangs for about an hour and I get the following error message:
Install-ADServiceAccount : Cannot install service account. Error Message: 'An unspecified error has occurred'.
At line:1 char:1
+ Install-ADServiceAccount gMSA-AD.Modify
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : WriteError: (gMSA-AD.modify:String) [Install-ADServiceAccount], ADException
+ FullyQualifiedErrorId : InstallADServiceAccount:PerformOperation:InstallServiceAcccountFailure,Microsoft.ActiveDirectory.Management.Commands.InstallADServiceAccount
I also now have problems creating new Group Managed Service Accounts on other servers in my Domain.
It may also be worth noting that, during the process of getting this server set back up our primary Domain Controller died. The backup Domain Controller took over and then all the roles were moved to that backup to make it become the primary. Since then the former primary Domain Controller has been rebuilt and is now a backup Domain Controller. Not sure if that would have anything to do with this error.