title: Where is the MSA operational log?
body: <p>I have created a gMSA like this:</p>
  
  <pre><code>New-ADServiceAccount -name Cust00000 -DNSHostName Cust00000.domain.com -PrincipalsAllowedToRetrieveManagedPassword "IIS_IUSRS" -ManagedPasswordIntervalInDays 60
  </code></pre>
  
  <p>And life seems to be good. However, when I run </p>
  
  <pre><code>Test-ADServiceAccount Cust00000
  </code></pre>
  
  <p>This is what I get:</p>
  
  <pre><code>False
  WARNING: Test failed for Managed Service Account Cust00000. If standalone Managed Service Account, the account is
  linked to another computer object in the Active Directory. If group Managed Service Account, either this computer does
  not have permission to use the group MSA or this computer does not support all the Kerberos encryption types required
  for the gMSA. See the MSA operational log for more information.
  </code></pre>
  
  <p>I checked event viewer -> Application and Services Logs -> Microsoft -> Windows -> Apps -> Microsoft-Windows-TWinUI/Operational but this does not appear to be correct. Where (and possibly what) is the MSA operational log?</p>
  
  <p>EDIT: For the overall issue, I had tried <code>Install-ADServiceAccount</code> but it wasn't working. I gave up on that and finally got it working (for a gMSA named Domain\sirdank$) with <code>Set-ADServiceAccount sirdank -PrincipalsAllowedToRetrieveManagedPassword "$env:computername$"</code> I've also had luck with passing "Domain Computers" instead of "$env:computername$".</p>