Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to use PowerShell DSC to add a domain group to the local administrators group. Here is the code:

Configuration TestSetup {
    Node localhost {
        Group Administrators {
            GroupName = "Administrators"
            MembersToInclude = "MYDOMAIN\TheAdministratorsGroup"

This is resulting in the following error when I run it:

PowerShell provider MSFT_GroupResource  failed to execute Test-TargetResource functionality with error message: Could not find a principal with the provided name [mydomain\theadministratorsgroup]
    + CategoryInfo          : InvalidOperation: (:) [], CimException
    + FullyQualifiedErrorId : ProviderOperationExecutionFailure
    + PSComputerName        : localhost

The principal does exist and I can add it manually through the GUI and using net localgroup.

I know that DSC configurations get executed under the SYSTEM account so I thought it might be a permissions issue with the SYSTEM account wanting to query Active Directory. However I've run a cmd as the SYSTEM account using PsExec and I was able to add a domain group to the local administrators group without any trouble.

share|improve this question

You have to specify the credentials:


Way to get the credentials:

$securedstring = ConvertTo-SecureString -String $Password -AsPlainText -Force
[PSCredential]$cred = New-Object System.Management.Automation.PSCredential ($UserName, $securedstring)

And this is the code u need to configure the DSC resource

$ConfigurationData = @{
    AllNodes = @(

Node $AllNodes.NodeName
        RebootNodeIfNeeded = $false

    Group $group.Name
        GroupName = $group.Name
        Ensure = $group.Ensure
        Members = $group.Members
        Credential = $cred

Then simply execute

ProcessDscResources -ConfigurationData $ConfigurationData -OutputPath $folderPathTmp

Start-DscConfiguration -Wait -Force -Path $folderPathTmp
share|improve this answer
Thanks a lot @Jupaoi, this was helpful and fairly undocumented in the official docs. – Nathan Dec 23 '14 at 19:32
Is there a way to tell it, it should just use "the current credentials" – TGlatzer Apr 15 '15 at 12:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.