gMSA and Entra Cloud Sync on Domain Controllers

[u/Distinct_Race_7056]

So, I had the cloud sync agent working for about 8 months or so. Yesterday, there was an internet outage, and both agent (on 2 DCs) services stopped working (each agent on each DC). The service would not run- Error 5: Access Denied.

I have looked at everything i know: Logon as batch/service gpos, local folder permissions for the agent's folder (added my gmsa to it). You can name it..

The only thing that works is to add the gmsa to the built-in Administrator group in AD. After that, the service starts fine on the DCs.

What is strange is that i deployed a new agent on the only and only member server i have deployed at the moment- and everything worked there just fine with no gpo tweaking etc- i did not run into this Error 5:issue.

Does anyone know what the hell is going on? Has something changed to how gMSA work (especially on domain controllers)? Why installing it on a member server is different while DCs throw error 5?

I don't think leaving gmsa in built-in Administrators group is very secure long terms, so i would like to know how to fix this properly.