Additional Accounts / gMSA Support

[deedubb]

Hello,

In https://github.com/MicrosoftDocs/Virtualization-Documentation/blob/live/windows-server-container-tools/ServiceAccounts/CredentialSpec.psm1 we see references to "gmsa3" an account residing in a child domain. I am attempting to get gMSA working over a domain trust (not a child domain). I have created a GMSA account in the other domain, however, I cannot figure out how to configure it, and how to keep the password in keyvualt.

The powershell script here suggests that I add the netbios/dns entry for the domain:

credspec:
ActiveDirectoryConfig:
GroupManagedServiceAccounts:
- Name: AppNpd_GMSA
Scope: MAINDOMAIN
- Name: AppNpd_GMSA
Scope: maindomain.local
- Name: AppNpd_GMSA
Scope: TRUSTDOMAIN
- Name: AppNpd_GMSA
Scope: trustdomain.local

However, I would expect the system needs the password/secret for the account as well; no?

Is my approach wrong? do I make multiple gmsa-spec files? never been done/never been tested?

Any assistance would be greatly appreciated!