dsccommunity / dsccommunity/ActiveDirectoryDsc
ADGroup: Cannot add group from trusting domain using distinguished name
Open
Nobody has claimed this yet.
enhancement
help wanted
- Dominant language
- PowerShell
- Stars
- 388
- Forks
- 141
- PR merge metrics
- No merged PRs in 30d
Description
Problem description
Trying to add a group from a trusting domain to a domain local group using distinguished name.
working with ActiveDirectory 6.1.0-preview0005
NOT working with ActiveDirectory 6.2.0
Verbose logs
VERBOSE: [server]: LCM: [ Start Resource ] [[ADGroup]Group]
VERBOSE: [server]: LCM: [ Start Test ] [[ADGroup]Group]
VERBOSE: [server]: [[ADGroup]Group] Retrieving AD Group 'Group'. (ADG0021)
VERBOSE: [server]: [[ADGroup]Group] The AD Group 'Group' is present. (ADG0023)
VERBOSE: [server]: [[ADGroup]Group] Retrieving group membership based on 'DistinguishedName' property. (ADG0001)
VERBOSE: [server]: [[ADGroup]Group] Checking for 'Included' members. (ADCOMMON0019)
VERBOSE: [server]: [[ADGroup]Group] Member 'CN=Group,DC=domain,DC=tld' is not in the desired state. (ADCOMMON0021)
VERBOSE: [server]: [[ADGroup]Group] Membership is NOT in the desired state. (ADCOMMON0024)
VERBOSE: [server]: [[ADGroup]Group] Group membership is NOT in the desired state. (ADG0002)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'Ensure' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'Category' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'GroupScope' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'Description' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'Notes' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'Path' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'GroupName' is in desired state. (DRC0039)
VERBOSE: [server]: LCM: [ End Test ] [[ADGroup]Group] in 0.0320 seconds.
VERBOSE: [server]: LCM: [ Start Set ] [[ADGroup]Group]
VERBOSE: [server]: [[ADGroup]Group] Retrieving AD Group 'Group'. (ADG0021)
VERBOSE: [server]: [[ADGroup]Group] The AD Group 'Group' is present. (ADG0023)
VERBOSE: [server]: [[ADGroup]Group] Retrieving group membership based on 'DistinguishedName' property. (ADG0001)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'Ensure' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'Category' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'GroupScope' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'Description' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'Notes' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'Path' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] The parameter 'GroupName' is in desired state. (DRC0039)
VERBOSE: [server]: [[ADGroup]Group] Adding 'CN=Group,DC=domain,DC=tld' member(s) to AD group 'Group'. (ADG0003)
VERBOSE: [server]: LCM: [ End Set ] [[ADGroup]Group] in 0.0620 seconds.
PowerShell DSC resource MSFT_ADGroup failed to execute Set-TargetResource functionality with error message: System.InvalidOperationException: Unable to resolve ObjectSID value from DistinguishedName
'CN=Group,DC=domain,DC=tld'. (ADCOMMON0062)
+ CategoryInfo : InvalidOperation: (:) [], CimException
+ FullyQualifiedErrorId : ProviderOperationExecutionFailure
+ PSComputerName : server.domain.dom
DSC configuration
$DN = (Get-ADGroup -Server 'trusting domain' -Identity 'Groupname').DistinguishedName
...
ADGroup 'Group' {
GroupName = 'Group'
GroupScope = 'DomainLocal'
Category = 'Security'
MembershipAttribute = 'DistinguishedName'
MembersToInclude = @($DN)
Description = 'Text'
Notes = 'Text'
Path = $Path
Ensure = 'Present'
}
Suggested solution
No
Operating system the target node is running
OsName : Microsoft Windows Server 2016 Standard
OsOperatingSystemSKU : StandardServerEdition
OsArchitecture : 64-bit
WindowsBuildLabEx : 14393.5582.amd64fre.rs1_release.221130-1719
OsLanguage : en-US
OsMuiLanguages : {en-US}
PSComputerName : server.domain.dom
RunspaceId : a773a2d0-30f5-4d06-bcd9-2b0264011b7c
PowerShell version and build the target node is running
Name Value
---- -----
PSVersion 5.1.14393.5127
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.5127
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
ActiveDirectoryDsc version
Name Version Path
---- ------- ----
ActiveDirectoryDsc 6.2.0 C:\Program Files\WindowsPowerShell\Modules\ActiveDirectoryDsc\6.2.0\ActiveDirectoryDsc.psd1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the ADGroup resource's MembershipAttribute=DistinguishedName handling and the ObjectSID resolution that emits ADCOMMON0062. Reproduce the Set operation with a domain-local group and a DN returned from the trusting domain; done means the trusted-domain member is accepted and subsequent Test and Set runs report the membership in the desired state.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- authorization, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100