[EMEA] - Cannot retrieve attributes to send approval emails suing GMSA (4381965)

When using a GMSA as gpoadmin service account. We are unable to read attributes using ldap queries for users assigned to approvals. It works with a normal service account. Even though GMSA is granted explicit read permission on all uses in AD. event 2013 The following error occurred attempting to retrieve the trustees email address: The specified directory service attribute or value does not exist. Attempting direct query method. -------------------------------------------- event 2013 The following error occurred attempting to retrieve the trustees email address using the direct query method: The specified directory service attribute or value does not exist. .--------------------------------- event 0 Failed to retrieve the email address for the account

The problem seems to be related to the permissions and capabilities of the gMSA

GPOAdmin requires the service account to have:

1. Read access to user attributes — but not only the default “read” permission
The specific attribute needed is:

mail
potentially proxyAddresses (if GC failover happens)
userPrincipalName

Even if the gMSA was granted “read permissions”, GPOAdmin performs LDAP queries sometimes performed via the Global Catalog, and gMSAs frequently lack GC query capability unless explicitly granted.

2. The gMSA must have “Read all properties” + “List object” at minimum on:

The domain root
The Users OU (or wherever users reside)
A common root cause
The gMSA does not have “Read email address (mail)” on users when queries are performed via the Global Catalog.
This happens because GC exposes a filtered attribute set. You must explicitly allow read on GC too.

 Assign the required permissions at the domain level
Grant the gMSA (or a group containing it):

Read All Properties
Read permissions on “mail”, “proxyAddresses”, and “UPN”
List Contents / List Object

Apply at:

Domain root (important for GC!)
The Users OU (or custom OUs where your users live)

Workaround:

Use the notification manager to add an email address to the configuration store for the required user, which will give it an address to use when the AD email check fails.