Exemple if you create a account with KerberosEncryptionType = AES256
The creation of a GMSA account let the parameter "KerberosEncryptionType" in {RC4, AES128, AES256} (Default behavior when you let this paramter empty)
When you reapply a second time while the account is already created the parameter is changed correctly to AES256
Add the parameter kerberosencryptiontype in the creation as the CMDLET
Exemple if you create a account with KerberosEncryptionType = AES256 The creation of a GMSA account let the parameter "KerberosEncryptionType" in {RC4, AES128, AES256} (Default behavior when you let this paramter empty) When you reapply a second time while the account is already created the parameter is changed correctly to AES256
Add the parameter kerberosencryptiontype in the creation as the CMDLET
new-adserviceaccount -kerberosencryptiontype