To deploy a gMSA, you must first ensure the Active Directory forest is prepared by creating the KDS Root Key, which is required by Domain Controllers to generate gMSA passwords. Once the key is active (or immediately in a lab environment with the effective date set to the past), you create the gMSA using PowerShell (e.g., New-ADServiceAccount), specifying which hosts are authorized to retrieve the password. Finally, you configure the IIS application pool identity on the target web server to use the gMSA. This is done by selecting "Custom Account" (specified user) and entering the gMSA name followed by a dollar sign (e.g., domain\gMSA$), leaving the password fields blank as Windows manages them automatically.

Microsoft Learn: "Create the Key Distribution Services KDS Root Key." This document specifies that the KDS root key is a prerequisite for creating gMSAs in a domain to ensure password security and generation.

Microsoft Learn: "Getting Started with Group Managed Service Accounts." This official documentation outlines the step-by-step process: Create the KDS Root key, create the gMSA account, and then install it on the host.

Microsoft Learn: "New-ADServiceAccount (ActiveDirectory)." This technical reference details the parameters required to create the account in Active Directory, specifically the -PrincipalsAllowedToRetrieveManagedPassword parameter.

Microsoft Learn: "Application Pool Identity." This guide explains how to configure IIS to use a specific identity, noting that for gMSAs, the account is treated as a specified user with a null password in the configuration UI.