Explanation:
several questions asked if different ways, come down to the same basic answer:
Add-kdsrootkey (on a domain controller; if it was never configured in the past) Add-ADServiceAccount (on domain controller - specify a server name, with $ at the end:
servername$ or a security group name)
Install-ADServiceAccount (on the server where gMSA account will be used, specify with the servername$)
https://docs.microsoft.com/en-us/windows-server/security/group-managed-service- accounts/create-the-key-distribution-services-kds-root-key
https://docs.microsoft.com/en-us/windows-server/security/group-managed-service- accounts/getting-started-with-group-managed-service-accounts