Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to use PowerShell DSC to add a domain group to the local administrators group. Here is the code:

Configuration TestSetup {
    Node localhost {
        Group Administrators {
            GroupName = "Administrators"
            MembersToInclude = "MYDOMAIN\TheAdministratorsGroup"
        }
    }
}

This is resulting in the following error when I run it:

PowerShell provider MSFT_GroupResource  failed to execute Test-TargetResource functionality with error message: Could not find a principal with the provided name [mydomain\theadministratorsgroup]
    + CategoryInfo          : InvalidOperation: (:) [], CimException
    + FullyQualifiedErrorId : ProviderOperationExecutionFailure
    + PSComputerName        : localhost

The principal does exist and I can add it manually through the GUI and using net localgroup.

I know that DSC configurations get executed under the SYSTEM account so I thought it might be a permissions issue with the SYSTEM account wanting to query Active Directory. However I've run a cmd as the SYSTEM account using PsExec and I was able to add a domain group to the local administrators group without any trouble.

share|improve this question

1 Answer 1

You have to specify the credentials:

Example:

Way to get the credentials:

$securedstring = ConvertTo-SecureString -String $Password -AsPlainText -Force
[PSCredential]$cred = New-Object System.Management.Automation.PSCredential ($UserName, $securedstring)

And this is the code u need to configure the DSC resource

$ConfigurationData = @{
    AllNodes = @(
        @{
            NodeName="*"
            PSDscAllowPlainTextPassword=$true
         }
        @{
            NodeName="SRV2-WS2012R2"
         }
        @{
            NodeName="SRV3-WS2012R2"
         }
   )
}


Node $AllNodes.NodeName
{
    LocalConfigurationManager
    {
        RebootNodeIfNeeded = $false
    }

    Group $group.Name
    {
        GroupName = $group.Name
        Ensure = $group.Ensure
        Members = $group.Members
        Credential = $cred
    }
}

Then simply execute

ProcessDscResources -ConfigurationData $ConfigurationData -OutputPath $folderPathTmp

Start-DscConfiguration -Wait -Force -Path $folderPathTmp
share|improve this answer
    
Thanks a lot @Jupaoi, this was helpful and fairly undocumented in the official docs. –  Nathan 2 days ago

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.