Azure / Azure/ArcEnabledServersGroupPolicy

Domain Admins require full permissions to network share to run the script

Open
#31 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
17
Forks
25
PR merge metrics
No merged PRs in 30d

Description

The documentation is slightly incorrect - it says that for the Network Share, it is sufficient for Domain Admins to have Change permissions. This is incorrect - the user running the script requires Full Control.

Running DeployGPO.ps1 as a Domain Admin with only Change permissions (instead of Full Control) results in:

```
Remote path \\contoso.com\Deployment\Azure Arc Servers Onboarding found!
Creating remote folder's structure...
Assigning appropriate permissions...
Set-Acl : Attempted to perform an unauthorized operation.
At C:\Users\\Downloads\ArcEnabledServersGroupPolicy_v1.0.8\ArcEnabledServersGroupPolicy_v1.0.8\DeployGPO.ps1:
108 char:1
+ Set-Acl -Path $AzureArcDeployPath -AclObject $Acl
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: [\\contoso.com...\AzureArcDeploy:String) [Set-Acl], UnauthorizedAcce
ssException
+ FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetAclCommand
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.