KDS Root Key Issues

Question

Hi Guys,
So this issue started during a test deployment of ADFS. I wast to use gMSA so I used the option "Create Group Managed Service Account" but it failed during the install.
Troubleshooting:
- Patch & reboot DC
- Enable Windows Firewall
- Check Root Key showing ok in ADSS/Services
- Tried different DC
- ADD new KDS Root Key
- Wait 10Hrs
- Checked event log
After this I was just going to create a gMSA manually. Here was my process:
PS C:\Users\super51b> get-kdsrootkey
AttributeOfWrongFormat :
KeyValue               : {99, 116, 39, 17...}
EffectiveTime          : 1/04/2014 7:48:43 p.m.
CreationTime           : 1/04/2014 7:48:43 p.m.
IsFormatValid          : True
DomainController       : CN=************=****,OU=Domain Controllers,DC=***,DC=local
ServerConfiguration    : Microsoft.KeyDistributionService.Cmdlets.KdsServerConfiguration
KeyId                  : **************-******-******-******-**************
VersionNumber          : 1
PS C:\Users\super51b> test-kdsrootkey -keyid "**************-******-******-******-**************"
test-kdsrootkey : There are no more endpoints available from the endpoint mapper. (Exception from HRESULT: 0x800706D9)
At line:1 char:1
+ test-kdsrootkey -keyid "**************-******-******-******-**************"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Test-KdsRootKey], COMException
    + FullyQualifiedErrorId : There are no more endpoints available from the endpoint mapper. (Exception from HRESULT:
    0x800706D9),Microsoft.KeyDistributionService.Cmdlets.TestKdsRootKeyCommand
Then I thought I would just try create the account anyway so i ran:
New-ADServiceAccount -name <ServiceAccountName> -DNSHostName <fqdn> -PrincipalsAllowedToRetrieveManagedPassword <group> -ServicePrincipalNames <SPN1,SPN2,…>
But recived the same error.
I tried adding a new KDS Root Key but also got the same error.
A bit of research only brings up Exchange Install issues that relate the the Windows Firewall being disabled so I enabled it ran again but got the same result.
I don't wan't to delete the KDS Root Key in-case it is in us.
Anyone seen this before???

Answer 1

You need to have a DC running 2012+ in the default DC container not in sub OUs/Containers what a massive waste of time for such a retarded issue.