Initialize-HgsServer fails when Kerberos RC4 is disabled
If you modify the security setting "Network security: Configure encryption types allowed for Kerberos" to only allow AES and not RC4, you get this error when initializing the Host Guardian Service
New-HgsGmsa : Active Directory operation failed with the following error:
Install-ADServiceAccount : Cannot install service account. Error Message: 'The provided context did not match the
This happens with gMSA accounts and is described in this blog post
The New-ADServiceAccount command within HgsServer.psm1 should be modified to pass the KerberosEncryptionTypes parameter.