Problems and Solutions

Windows server 2012: Managed Service Accounts Error

Hello everybody….

Windows server 2012 launched, and sure a lot of you guys started working with new features that added to the server… about me I used it from the beta version I like it very much… last night I decided to create  (Managed Service Accounts) I started PowerShell and wrote the correct command but I faced the following error:


I became doubt myself ( looooool) and I tried to change the command but trust me I was sure this is the correct command,,, I started my tour to find a solution and I find the following note: “You must wait 10 hours from creation time to allow all DCs to converge AD replication before you can create gMSA. 10 hours prevents password generation from occurring before all DCs in environment capable of answering gMSA requests.”

But in my in my environment I used only one DC; should I wait 10 hours??? in fact No. I used the following command: 

Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10))

Which Allows using gMSAs immediately, because it sets the start time 10 hours in past. After that everything worked fine as below in the snapshot….I hope this help you 🙂


By Eng. Abdallah Sawalha

IT Consultant and Trainer

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s