Я пытаюсь использовать этот модуль как часть автоматизации AD в AWS.
Скрипт
... Install RSAT-AD-PowerShell & xActiveDirectory ... then
Configuration DevAws
{
Import-DscResource –ModuleName PSDesiredStateConfiguration
Import-DscResource -Module xActiveDirectory
Node localhost
{
xADUser MattCanty
{
UserName = "matt.canty"
DomainName = "dev.aws"
}
}
}
DevAws
Start-DscConfiguration -Path ./DevAws -Wait -Verbose -Force
Журнал
Directory: C:\Users\admin\Documents\DevAws
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 7/18/2018 5:06 PM 1896 localhost.mof
VERBOSE: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = SendConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespace
Name' = root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: An LCM method call arrived from computer EC2AMAZ-75TV86U with user sid S-1-5-21-264491047-2034986546-3023887121-1105.
VERBOSE: [EC2AMAZ-75TV86U]: LCM: [ Start Set ]
VERBOSE: [EC2AMAZ-75TV86U]: LCM: [ Start Resource ] [[xADUser]MattCanty]
VERBOSE: [EC2AMAZ-75TV86U]: LCM: [ Start Test ] [[xADUser]MattCanty]
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] Retrieving Active Directory user 'matt.canty' ([email protected]) ...
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] Active Directory user 'matt.canty' ([email protected]) was NOT present.
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] User 'Ensure' property is NOT in the desired state. Expected 'Present', actual 'Absent'.
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] User 'Enabled' property is NOT in the desired state. Expected 'True', actual ''.
VERBOSE: [EC2AMAZ-75TV86U]: LCM: [ End Test ] [[xADUser]MattCanty] in 0.5470 seconds.
VERBOSE: [EC2AMAZ-75TV86U]: LCM: [ Start Set ] [[xADUser]MattCanty]
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] Retrieving Active Directory user 'matt.canty' ([email protected]) ...
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] Active Directory user 'matt.canty' ([email protected]) was NOT present.
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] Adding Active Directory user 'matt.canty'.
Access is denied
+ CategoryInfo : PermissionDenied: (CN=matt.canty,O...s,DC=dev,DC=aws:) [], CimException
+ FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.UnauthorizedAccessException,Microsoft.ActiveDirectory.Management.Commands.NewADUser
+ PSComputerName : localhost
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] Retrieving Active Directory user 'matt.canty' ([email protected]) ...
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] Active Directory user 'matt.canty' ([email protected]) was NOT present.
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] Updating user property 'Enabled' with/to 'True'.
VERBOSE: [EC2AMAZ-75TV86U]: [[xADUser]MattCanty] Updating Active Directory user 'matt.canty'.
Cannot find an object with identity: 'matt.canty' under: 'DC=dev,DC=aws'.
+ CategoryInfo : ObjectNotFound: (matt.canty:) [], CimException
+ FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException,Microsoft.ActiveDirectory.Management.Commands.SetAD
User
+ PSComputerName : localhost
VERBOSE: [EC2AMAZ-75TV86U]: LCM: [ End Set ] [[xADUser]MattCanty] in 0.3440 seconds.
The PowerShell DSC resource '[xADUser]MattCanty' with SourceInfo 'C:\Users\admin\Documents\Run-AdDsc.ps1::17::9::xADUser' threw one or more non-terminating errors while
running the Set-TargetResource functionality. These errors are logged to the ETW channel called Microsoft-Windows-DSC/Operational. Refer to this channel for more
details.
+ CategoryInfo : InvalidOperation: (:) [], CimException
+ FullyQualifiedErrorId : NonTerminatingErrorFromProvider
+ PSComputerName : localhost
VERBOSE: [EC2AMAZ-75TV86U]: LCM: [ End Set ]
The SendConfigurationApply function did not succeed.
+ CategoryInfo : NotSpecified: (root/Microsoft/...gurationManager:String) [], CimException
+ FullyQualifiedErrorId : MI RESULT 1
+ PSComputerName : localhost
VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Time taken for configuration job to complete is 1.484 seconds
```
Заметки
- Я вошел на сервер как администратор домена, который имеет подключение к AD.
- Я могу добавлять пользователей вручную.
- Я могу добавлять пользователей через
New-ADUser
На самом деле я хотел бы выполнить это удаленно, через CloudFormation или Run Command, что означает, что мне, вероятно, нужно будет каким-то образом включить PSCredential. Я не понимаю, как DomainAdministratorCredential на xADUser полезен, потому что этого свойства нет на xADGroup...
Любая помощь приветствуется, прежде чем я начну развертывать собственное решение!
Спасибо
