Group MSA account fail when Domain Controller in Test Domain Fails to start KdsSvc. Event ID 7023

Question

Yesterday, in my test domain, I created the KDS root key using the Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10))
command on a DC that is not the PDC Emulator because it was the server I was on at the time.  Today, when I tried to create gMSA accounts on the PDC emulator, I get:
Event ID 7023 The Microsoft Key Distribution Service terminated with the following error: An Exception occurred in the service when handling the control request
I turned on logging on to the KdsSvc and get 2 other errors:
KdsSvc Event ID 4001: Group Key Distribution Service failed to start. Status 0x80070020
KdsSvc Event ID 4007: Group Key Distribution Service cannot connect to the domain controller on local host.  Status 0x80070020.  Group Key Distribution Service cannot be started because of the error.  Please contact the administrator to resolve
the issue.
I took the opportunity to clean up AD, the Schema, and DNS, but the kds errors continues.  I am replicating successfully, DNS changes are reflected immediately, and when I run the get-KDSRootKey on the failing server, the key is returned.  The
Get-KdsConfiguration matches the KDS config on the DC that originally ran to create the key.
I have a pretty strict GPO pushed to my DCs but I am still able to create gMSAs on the other server.  I checked ADS&S and found the msKds-ProvRootKey so I know it is at the domain level, but there is so little documentation on the KdsSvc that I
am not sure if it is working as planned.  I have tried unassigning several GPO configuration items but I am throwing darts at this point.  I have also uninstalled McAfee AV; IDS/IPS; Firewall.
With that said, I have questions:
Will gMSAs still work even though the domain pdc emulator cannot start the service?
Is the KdsSvc supposed to start only on the server Add-KDSRootKey was originally created?
What happens if the server the KdsSvc key was created fails and has to be removed from the domain?
Is there any books or configuration items I can review to learn the KdsSvc better?
Env:
Windows Standard Server 2012 R2 x64
Active Directory 2012 R2 Schema Updated from Windows 2008 R2
All FSMO roles are on the PDC Emulator which is a Windows 2012 R2 DC
DCDiag returns no errors or test failures
Repadmin returns clean results (/showreps & /replsum)
Windows 2008 R2 Root CA hierarchy (not DCs)
W32tm services are running with less than 6/10's of a ms difference among the domain.

Answer 1

Hi,
For Windows Server 2012, the Windows PowerShell cmdlets default to managing the group Managed Service Accounts instead of the original standalone Managed
Service Accounts.
New-ADServiceAccount -name <ServiceAccountName> -DNSHostName <fqdn> -PrincipalsAllowedToRetrieveManagedPassword <group>
-ServicePrincipalNames <SPN1,SPN2,…>
Did you use the command abouve?
Here is a good bolg:
Windows Server 2012: Group Managed Service Accounts
http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx
Hope this helps.