Install-ADServiceAccount : An unspecified error has occurred

Question

Hi. I have two Windows Server 2012 R2 installed in test network. One is DC, another is SQL server (CM0 named).
Now, i would like to configure start SQL service as MSA.
I have created MSA on DC. Assigned to SQL server, and now i try to install this MSA on SQL server:
PS C:\> New-ADServiceAccount -Name TESTMSA -Enabled $true -DNSHostName CM0
PS C:\> Add-ADComputerServiceAccount -Identity CM0 -ServiceAccount TESTMSA
on SQL server:
PS C:\> Get-ADServiceAccount -Identity TESTMSA -Properties *
AccountExpirationDate :
accountExpires : 9223372036854775807
AccountLockoutTime :
AccountNotDelegated : False
AllowReversiblePasswordEncryption : False
AuthenticationPolicy : {}
AuthenticationPolicySilo : {}
BadLogonCount : 0
badPasswordTime : 0
badPwdCount : 0
CannotChangePassword : False
CanonicalName : voo.domain.com/Managed Service Accounts/TESTMSA
Certificates : {}
CN : TESTMSA
codePage : 0
CompoundIdentitySupported : {False}
countryCode : 0
Created : 17.07.2014 10:26:38
createTimeStamp : 17.07.2014 10:26:38
Deleted :
Description :
DisplayName :
DistinguishedName : CN=TESTMSA,CN=Managed Service Accounts,DC=voo,DC=domain,DC=com
DNSHostName : CM0
DoesNotRequirePreAuth : False
dSCorePropagationData : {01.01.1601 01:00:00}
Enabled : True
HomedirRequired : False
HomePage :
HostComputers : {CN=CM0,OU=servers,OU=sity,DC=voo,DC=domain,DC=com}
instanceType : 4
isCriticalSystemObject : False
isDeleted :
KerberosEncryptionType : {RC4, AES128, AES256}
LastBadPasswordAttempt :
LastKnownParent :
lastLogoff : 0
lastLogon : 0
LastLogonDate :
localPolicyFlags : 0
LockedOut : False
logonCount : 0
ManagedPasswordIntervalInDays : {30}
MemberOf : {}
MNSLogonAccount : False
Modified : 17.07.2014 10:26:38
modifyTimeStamp : 17.07.2014 10:26:38
msDS-HostServiceAccountBL : {CN=CM0,OU=servers,OU=sity,DC=voo,DC=domain,DC=com}
msDS-ManagedPasswordId : {1, 0, 0, 0...}
msDS-ManagedPasswordInterval : 30
msDS-SupportedEncryptionTypes : 28
msDS-User-Account-Control-Computed : 0
Name : TESTMSA
nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity
ObjectCategory : CN=ms-DS-Group-Managed-Service-Account,CN=Schema,CN=Configuration,DC=voo,D
C=domain,DC=com
ObjectClass : msDS-GroupManagedServiceAccount
ObjectGUID : fda9060b-0c24-4c6c-8756-bcb3622f0755
objectSid : S-1-5-21-1811451803-3665653429-3710297301-1176
PasswordExpired : False
PasswordLastSet : 17.07.2014 10:26:38
PasswordNeverExpires : False
PasswordNotRequired : False
PrimaryGroup : CN=Domain Computers,CN=Users,DC=voo,DC=domain,DC=com
primaryGroupID : 515
PrincipalsAllowedToDelegateToAccount : {}
PrincipalsAllowedToRetrieveManagedPassword : {}
ProtectedFromAccidentalDeletion : False
pwdLastSet : 130500591980747733
SamAccountName : TESTMSA$
sAMAccountType : 805306369
sDRightsEffective : 15
ServicePrincipalNames :
SID : S-1-5-21-1811451803-3665653429-3710297301-1176
SIDHistory : {}
TrustedForDelegation : False
TrustedToAuthForDelegation : False
UseDESKeyOnly : False
userAccountControl : 4096
userCertificate : {}
UserPrincipalName :
uSNChanged : 215990
uSNCreated : 215987
whenChanged : 17.07.2014 10:26:38
whenCreated : 17.07.2014 10:26:38
PS C:\> Install-ADServiceAccount -Identity "TESTMSA"
Install-ADServiceAccount : Cannot install service account. Error Message: 'An unspecified error has occurred'.
At line:1 char:1
+ Install-ADServiceAccount -Identity "TESTMSA"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : WriteError: (TESTMSA:String) [Install-ADServiceAccount], ADException
+ FullyQualifiedErrorId : InstallADServiceAccount:PerformOperation:InstallServiceAcccountFailure,Microsoft.ActiveD
irectory.Management.Commands.InstallADServiceAccount
goooooogle doesn't help me (
Thank you!

Answer 1

Marius
Ene
- with $a - same. about supporting - the link is about 2008 R2. I think MSA and gMSA was a little bit changed on 2012 R2.
about gMSA. I don't understand this key: 
-PrincipalsAllowedToRetrieveManagedPassword ITFarmHosts
what means ITfarmsHosts? is it some computer\user group or that?
PS C:\> New-ADServiceAccount TEST-gMSA -DNSHostName test-gmsa -PrincipalsAllowedToRetrieveManagedPassword TEST-gMSA -Ker
berosEncryptionType RC4, AES128, AES256
New-ADServiceAccount : Identity info provided in the extended attribute: 'PrincipalsAllowedToRetrieveManagedPassword'
could not be resolved. Reason: 'Cannot find an object with identity: 'TEST-gMSA' under: 'DC=voo,DC=domain,DC=com'.'.
At line:1 char:1
+ New-ADServiceAccount TEST-gMSA -DNSHostName test-gmsa -PrincipalsAllowedToRetrie ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidData: (CN=TEST-gMSA,CN...DC=lovoo,DC=com:String) [New-ADServiceAccount], ADIdenti
tyResolutionException
+ FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADIdentityResolutionException
,Microsoft.ActiveDirectory.Management.Commands.NewADServiceAccount