Add-KdsRootKey: The Microsoft Key Distribution Service (KDS) requires a root key to begin generating gMSA passwords. This cmdlet must be run once per forest on a Domain Controller to initialize the password generation process.

New-ADServiceAccount: This cmdlet creates the gMSA in Active Directory. During this step, you define which hosts are authorized to use the account by specifying the iTFarmHosts group in the -PrincipalsAllowedToRetrieveManagedPassword parameter.

Install-ADServiceAccount: Finally, this cmdlet must be executed on each cluster node. It validates that the local computer is authorized to use the gMSA and configures the local host to retrieve and cache the managed password.

Microsoft Documentation: Create the Key Distribution Services KDS Root Key. "The KDS root key is used by the KDS service on domain controllers to generate passwords... You must create a root key before you can create a gMSA."

Microsoft Documentation: Getting Started with Group Managed Service Accounts. Section: "Create a Group Managed Service Account." This section details the use of New-ADServiceAccount with the -PrincipalsAllowedToRetrieveManagedPassword parameter.

Microsoft Documentation: Install-ADServiceAccount. "The Install-ADServiceAccount cmdlet installs an existing Active Directory service account on the computer on which the cmdlet is run."

Windows Server Administration Guide: Chapter on Managed Service Accounts (MSAs), detailing the transition from standalone MSAs to Group MSAs (gMSAs) and the prerequisite of the KDS Root Key.