This recipe shows how to work with group Managed Service Accounts (gMSAs).
To create gMSAs, the Active Directory domain needs to have at least one domain controller running Windows Server 2012 or a newer version of Windows Server.
gMSAs can only be used to run services on domain-joined hosts running Windows Server 2012, or newer versions of Windows Server, or Windows 8, or newer versions of Windows. For the automatic password and Service Principal Name (SPN) management, the domain needs to run at least the Windows Server 2008 R2 Domain Functional Level (DFL).
As gMSAs depend on the Key Distribution Service on domain controllers, prepare the forest by running the following...