I am trying to use PowerShell DSC to add a domain group to the local administrators group. Here is the code:

Configuration TestSetup {
    Node localhost {
        Group Administrators {
            GroupName = "Administrators"
            MembersToInclude = "MYDOMAIN\TheAdministratorsGroup"

This is resulting in the following error when I run it:

PowerShell provider MSFT_GroupResource  failed to execute Test-TargetResource functionality with error message: Could not find a principal with the provided name [mydomain\theadministratorsgroup]
    + CategoryInfo          : InvalidOperation: (:) [], CimException
    + FullyQualifiedErrorId : ProviderOperationExecutionFailure
    + PSComputerName        : localhost

The principal does exist and I can add it manually through the GUI and using net localgroup.

I know that DSC configurations get executed under the SYSTEM account so I thought it might be a permissions issue with the SYSTEM account wanting to query Active Directory. However I've run a cmd as the SYSTEM account using PsExec and I was able to add a domain group to the local administrators group without any trouble.


You have to specify the credentials:


Way to get the credentials:

$securedstring = ConvertTo-SecureString -String $Password -AsPlainText -Force
[PSCredential]$cred = New-Object System.Management.Automation.PSCredential ($UserName, $securedstring)

And this is the code u need to configure the DSC resource

$ConfigurationData = @{
    AllNodes = @(

Node $AllNodes.NodeName
        RebootNodeIfNeeded = $false

    Group $group.Name
        GroupName = $group.Name
        Ensure = $group.Ensure
        Members = $group.Members
        Credential = $cred

Then simply execute

ProcessDscResources -ConfigurationData $ConfigurationData -OutputPath $folderPathTmp

Start-DscConfiguration -Wait -Force -Path $folderPathTmp
  • Thanks a lot @Jupaoi, this was helpful and fairly undocumented in the official docs. – Nathan Dec 23 '14 at 19:32
  • Is there a way to tell it, it should just use "the current credentials" – TGlatzer Apr 15 '15 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.