FSRM role fails to install or update on an RODC that is running Windows Server 2012, Windows Server 2012 R2 or Windows Server 2016

2018-09-26 22:15:25, Info CSI 000003d2 Begin executing advanced installer phase 31 index 936 (sequence 968)
Old component: [l:155 ml:156]Microsoft-Windows-FSRM-Service, Culture=neutral, Version=10.0.14393.1944, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS
New component: [l:155 ml:156]Microsoft-Windows-FSRM-Service, Culture=neutral, Version=10.0.14393.2515, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS
Install mode: delta
Smart installer: FALSE
Installer ID: {118ca598-79a0-4297-953d-e82183960fd2}
Installer name: Group Trustee Online Installer
2018-09-26 22:15:25, Info CSI 000003d3 Loading installer DLL from explicit path: C:\Windows\WinSxS\amd64_microsoft-windows-s..-installers-onecore_31bf3856ad364e35_10.0.14393.2272_none_6175530efffc72ea\grouptrusteeai.dll
2018-09-26 22:15:25, Info CSI 000003d4 Performing 1 operations as follows:
(0) LockComponentPath: flags: 0 comp: {l:16 b:9ee6eff30756d40160030000f8060c07} pathid: {l:16 b:9ee6eff30756d40161030000f8060c07} path: [l:110]\SystemRoot\WinSxS\amd64_microsoft-windows-fsrm-service_31bf3856ad364e35_10.0.14393.1944_none_163b6102218945b5pid: 6f8 starttime: 131824880970812628
2018-09-26 22:15:25, Info CSI 000003d5 Performing 1 operations as follows:
(0) LockComponentPath: flags: 0 comp: {l:16 b:9ee6eff30756d40162030000f8060c07} pathid: {l:16 b:9ee6eff30756d40163030000f8060c07} path: [l:110]\SystemRoot\WinSxS\amd64_microsoft-windows-fsrm-service_31bf3856ad364e35_10.0.14393.2515_none_16638af2216ba0b4pid: 6f8 starttime: 131824880970812628
2018-09-26 22:15:25, Info CSI 000003d6 QueueComponent called with Name: [l:30 ml:31]Access-Denied Assistance Users, Type: 4, Description: [l:185 ml:186]Members of this group are provided access-denied assistance when it is enabled on this server. By default, this group allows all authenticated users to receive access-denied assistance.

2018-09-26 22:15:25, Info CSI 000003d7 QueueComponent called with Name: [l:30 ml:31]Access-Denied Assistance Users, Type: 4, Description: [l:185 ml:186]Members of this group are provided access-denied assistance when it is enabled on this server. By default, this group allows all authenticated users to receive access-denied assistance.

2018-09-26 22:15:25, Info CSI 000003d8@2018/9/27:02:15:25.793CSI Advanced installer perf trace:
CSIPERF:AIDONE;{118ca598-79a0-4297-953d-e82183960fd2};Microsoft-Windows-FSRM-Service, version 10.0.14393.2515, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35};30480us
2018-09-26 22:15:25, Info CSI 000003d9 End executing advanced installer (sequence 968)
Completion status: S_OK

There is a second call into the advanced installer. That does the job of creating the account and that fails.

2018-09-26 22:15:34, Info CSI 000004a1 Begin executing advanced installer phase 31 index 0 (sequence 0)
Old component: [l:0]
New component: [l:0]
Install mode: delta
Smart installer: TRUE
Installer ID: {118ca598-79a0-4297-953d-e82183960fd2}
Installer name: Group Trustee Online Installer
2018-09-26 22:15:34, Error CSI 000004a2@2018/9/27:02:15:34.652(F) onecore\base\wcp\plugins\grouptrusteeai\grouptrusteeai.cpp(402): Error STATUS_NOT_SUPPORTED originated in function Windows::WCP::WCF::GroupTrusteeInstaller::AddTrustee expression: SamCreateAliasInDomain( domainHandle, &newTrustee->TrusteeName, 0x0010 | 0x0001 | 0x0002 | 0x0008, &trusteeHandle, &trusteeRid)
[gle=0x80004005]
2018-09-26 22:15: