Install-ADServiceaccount does not work with Security-Groups

Hi,

i have the following problem:

When I want to Install my gmsa with "PrincipalsAllowedToRetrieveManagedPassword" assigned to a Security-Group:

Install-ADServiceAccount gmsa_test

i got the following message:

Install-ADServiceAccount : Cannot install service account. Error Message: 'An unspecified error has occurred'.

and:

WARNING: Test failed for Managed Service Account gmsa_test. If standalone Managed Service Account, the account is
linked to another computer object in the Active Directory. If group Managed Service Account, either this computer does
not have permission to use the group MSA or this computer does not support all the Kerberos encryption types required
for the gMSA. See the MSA operational log for more information.

In the Event-Viewer, I got the following:

Netlogon failed to add gmsa_test as a managed service account to this local machine. {Access Denied}
A process has requested access to an object, but has not been granted those access rights.

If my gmsa_test is directly assigned with -PrincipalsAllowedToRetrieveManagedPassword "Server1$" to the server, it works well.

any ideas?

Thanks!

BR
Ludwig