A newly created gMSA works on older approved hosts but fails on a server just added to its authorized host group. DC replication is healthy. What should be checked next?

Choose the single best answer.

A.Refresh the server's machine group-membership token and test the account
B.Replace the gMSA with Domain Admins
C.Create a new KDS root key for each failed startup
D.Add every user to the password-retrieval group

Show the answer and explanation

✓ Correct answer

Refresh the server's machine group-membership token and test the account

A stale machine token can omit the newly granted host-group membership. Adding all users broadens secret access, and Domain Admins is unnecessary service privilege. Recreating root keys per startup introduces risk without addressing host-token state.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.