ADUser: Issue with when target node uses SSL PS- and CIM-Sessions

Hi,

I am using DSC to create AD service accounts, using the xADUser resource, e.g.

_xADUser SQLEngineServiceAccount {
    DomainName = $MachineDomain
    Username = $($SQLEngineServiceAccountCredential.UserName).Split("\")[1]
    CannotChangePassword = $true
    Ensure = "$Ensure"
    Password = $SQLEngineServiceAccountCredential
    PsDscRunAsCredential = $AllNodes.ServiceAccountCreatorCredential
    Description = "SQL Engine service account for $MachineName"
    Path = $StreamServiceAccountOUDN
    DependsOn = "[cWindows2012R2]OSConfig"
}_

This works fine when the target machine has a HTTP WinRM endpoint.
However, we're in a secure environment and are auto-generating node-specific certificates in order to do such things as securing the MOF (the credentials in it) at rest.
The target nodes therefore have WinRM configured for HTTPS (the default HTTP listener is removed). (So to remotely connect to machine we need to initiate SSL PSSessions and SSL CIMSessions).

With this configuration enabled, the xADUser resource produces an error, as follows:
VERBOSE: [PNL1006VSUA0168]: LCM: [ Start Test ] [[xADUser]SQLEngineServiceAccount::[cSQLServer2012]SQLServer2012]
VERBOSE: [PNL1006VSUA0168]: [[xADUser]SQLEngineServiceAccount::[cSQLServer2012]SQLServer2012] Importing the module MSFT_xADUser in force mode.
VERBOSE: [PNL1006VSUA0168]: LCM: [ End Test ] [[xADUser]SQLEngineServiceAccount::[cSQLServer2012]SQLServer2012] in 3.0470 seconds.
Connecting to remote server localhost failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.
+ CategoryInfo : OpenError: (:) [], CimException
+ FullyQualifiedErrorId : RemoteRunspaceCreationFailed
+ PSComputerName : pnl1006vsua0168.thedomain.local

To re-iterate, with the WinRM HTTP listener in place, this error is not seen and the AD service account is created.

Can you comment on whether xADUser supports endpoints with WinRM HTTPS endpoints? I can't think of a reason why it wouldn't but can see references to New-CIMInstance in some of the PowerShell module code.

Start with the xADUser resource and inspect the module code references to New-CIMInstance and MSFT_xADUser. Reproduce the resource with an HTTPS-only WinRM endpoint, comparing it with the reported HTTP configuration, and determine whether the failure is in resource behavior or documented endpoint support. Done means the HTTPS case works or its limitation and required configuration are clearly documented.