Azure / Azure/ArcEnabledServersGroupPolicy
Domain Admins require full permissions to network share to run the script
- Dominant language
- PowerShell
- Stars
- 17
- Forks
- 25
- PR merge metrics
- No merged PRs in 30d
Description
The documentation is slightly incorrect - it says that for the Network Share, it is sufficient for Domain Admins to have Change permissions. This is incorrect - the user running the script requires Full Control.
Running DeployGPO.ps1 as a Domain Admin with only Change permissions (instead of Full Control) results in:
```
Remote path \\contoso.com\Deployment\Azure Arc Servers Onboarding found!
Creating remote folder's structure...
Assigning appropriate permissions...
Set-Acl : Attempted to perform an unauthorized operation.
At C:\Users\\Downloads\ArcEnabledServersGroupPolicy_v1.0.8\ArcEnabledServersGroupPolicy_v1.0.8\DeployGPO.ps1:
108 char:1
+ Set-Acl -Path $AzureArcDeployPath -AclObject $Acl
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: [\\contoso.com...\AzureArcDeploy:String) [Set-Acl], UnauthorizedAcce
ssException
+ FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetAclCommand
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.