When using the ContainerD runtime (Feature State: Kubernetes v1.19 [beta]) accessing restricted network shares via the GMSA domain identity fails. The container will receive the identity of and calls from nltest.exe /query will work. It is recommended to use the Docker EE runtime if access to network shares is required.