Troubleshooting gMSA password retrieval failures on servers

Hi Advait Mohammad,

The “failed to retrieve password” error usually points to either a timing problem with the KDS root key or a permissions scope issue. If the KDS root key was only recently created, remember that it can take up to 10 hours for domain controllers to fully propagate the key material. During that window, gMSA accounts may not be able to retrieve their passwords reliably.

Another common cause is that the servers running the gMSA‑based service aren’t properly listed in the security group or principals allowed to retrieve the managed password. Double‑check the configuration in Active Directory to ensure those servers are authorized. You can validate this by running Test-ADServiceAccount on the affected servers, which will confirm whether the account can be used successfully.

It’s also worth checking replication health across domain controllers, since inconsistent AD replication can block password retrieval. Reviewing the System and Directory Services logs on the affected servers often points to whether the failure is due to permissions or replication delays.

If you suspect the KDS root key propagation delay, waiting until the key has fully synchronized usually resolves the issue. If permissions are the culprit, updating the allowed principals scope and re‑running the service account test should fix it.

Jason.