ADMF cannot remove a deleted computer from a gMSA.
Prerequisites
- There is a gMSA. Two computers are assigned to it via ComputerName.
- One of the computers was deleted.
Steps Leading to the Error
If you run Invoke-ADMFDomain -Options ServiceAccount, you will receive an error:
“Get-ADObject: Cannot find an object with identity: ‘S-1-5-...’ under:
%DomainDN%”
Workaround
You can correct this manually using Set-ADServiceAccount.
Script
The error can be reproduced using the files in the ZIP archive.
Invoke-Issue.ps1
- creates an OU using ADMF
- creates two computer objects
- creates a gMSA using ADMF with both computers as authorized.
- deletes one of the computers
- Checks the gMSA using ADMF to ensure both computers are authorized. This then leads to the error
Remove-OU.ps1
- Removes all objects in the created OU and then the OU itself
ADMF cannot remove a deleted computer from a gMSA.
Prerequisites
Steps Leading to the Error
If you run
Invoke-ADMFDomain -Options ServiceAccount, you will receive an error:Workaround
You can correct this manually using
Set-ADServiceAccount.Script
The error can be reproduced using the files in the ZIP archive.
Invoke-Issue.ps1
Remove-OU.ps1