I'm trying to create a DSC script that can be run locally on a machine that is to be a Read Only Domain Controller. The xActiveDirectory DSC resource doesn't provide for creating an RODC so I have to use a script resource and use Install-ADDSDomainController.
My problem arises when I have to provide the Safe Mode Administrator Password. The parameter will only accept a SecureString, however I'm having trouble passing through the secure string to the DSC configuration. I can pass through a PSCredential object for the Credential parameter but the Safe Mode parameter won't accept it so I need a separate variable. I am encrypting the credentials with a self signed cert which seems to be working ok at this point.
My DSC code, there are a couple of commented out lines at the bottom where I tested alternate ways of creating the secure string non of which worked:
get-childitem cert:\localmachine\my | where-object {$_.Subject -like "*CN=DscEncryptionCert*"} | remove-item
$cert = New-SelfSignedCertificate -Type DocumentEncryptionCertLegacyCsp -DnsName 'DscEncryptionCert' -HashAlgorithm SHA256
$cert | Export-Certificate -FilePath "c:\RODC\DscPublicKey.cer" -Force
$thumbprint = (get-childitem cert:\localmachine\my | where-object {$_.Subject -like "*CN=DscEncryptionCert*"}).Thumbprint
$ConfigData= @{
AllNodes = @(
@{
NodeName = "localhost"
CertificateFile = "C:\RODC\localhost.cer"
Thumbprint = $thumbprint
};
);
}
configuration RODC
{
param(
[Parameter()]$DomainName,
[Parameter()]$ReplicationSourceDC,
[Parameter()]$SiteName,
[Parameter()]$Thumbprint,
[PSCredential]$PSCredential = $PSCredential,
[Parameter(Mandatory=$true)]
[ValidateNotNullOrEmpty()]
[System.Security.SecureString]$safemodepassword = $safemodepassword
)
Import-DscResource -module 'PSDesiredStateConfiguration'
Node localhost
{
LocalConfigurationManager
{
CertificateId = $Thumbprint
}
WindowsFeature ADDSInstall
{
Ensure = 'Present'
Name = 'AD-Domain-Services'
IncludeAllSubFeature = $true
}
script installRODC
{
DependsOn = '[WindowsFeature]ADDSInstall'
SetScript =
{
Import-Module ADDSDeployment
Install-ADDSDomainController `
-AllowPasswordReplicationAccountName @("test\Allowed RODC Password Replication Group") `
-NoGlobalCatalog:$false `
-Credential:$PSCredential `
-CriticalReplicationOnly:$false `
-DenyPasswordReplicationAccountName @("BUILTIN\Administrators", "BUILTIN\Server Operators", "BUILTIN\Backup Operators", "BUILTIN\Account Operators", "test\Denied RODC Password Replication Group") `
-DomainName:$using:DomainName `
-InstallDns:$true `
-NoRebootOnCompletion:$false `
-ReadOnlyReplica:$true `
-ReplicationSourceDC:$using:ReplicationSourceDC `
-SiteName $using:SiteName `
-Force:$true `
-SafeModeAdministratorPassword:$safemodepassword
}
TestScript =
{
if((get-wmiobject win32_computersystem).domainrole -eq 4){$true}else{$false}
}
GetScript =
{
Return @{result = (get-wmiobject win32_computersystem).domainrole}
}
}
}
}
$PSCredential = Get-Credential
$safemodepassword = Read-Host -assecurestring "Please enter the Safe Mode Administrator password"
#$safemodepassword = ConvertTo-SecureString "P@55word" -AsPlainText -Force
#$safemodepassword = New-Object System.Management.Automation.PSCredential ("Administrator", $password)
RODC -DomainName test.local -ReplicationSourceDC DC1.test.local -Sitename Site11 -PSCredential $PSCredential -safemodepassword $safemodepassword
Set-DscLocalConfigurationManager -path .\RODC -Verbose -Force
Start-DscConfiguration -path .\RODC -Verbose -force
A simple test I wrote to check if the script code itself is working, which it is:
$PSCredential = Get-Credential
$safemodepassword = Read-Host -assecurestring "Please enter the Safe Mode Administrator password"
$DomainName = "test.local"
$ReplicationSourceDC = "DC1.test.local"
$Sitename = "Site11"
Install-ADDSDomainController `
-AllowPasswordReplicationAccountName @("test\Allowed RODC Password Replication Group") `
-NoGlobalCatalog:$false `
-Credential:$PSCredential `
-CriticalReplicationOnly:$false `
-DenyPasswordReplicationAccountName @("BUILTIN\Administrators", "BUILTIN\Server Operators", "BUILTIN\Backup Operators", "BUILTIN\Account Operators", "test\Denied RODC Password Replication Group") `
-DomainName:$DomainName `
-InstallDns:$true `
-NoRebootOnCompletion:$false `
-ReadOnlyReplica:$true `
-ReplicationSourceDC:$ReplicationSourceDC `
-SiteName $SiteName `
-Force:$true `
-SafeModeAdministratorPassword:$safemodepassword
The main error I get is:
PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: Cannot bind parameter 'SafeModeAdministratorPassword' to the target. Exception setting "SafeModeAdministratorPassword": "SafeModeAdministratorPassword cannot be null."
Is it NULL because it's not being passed through correctly? If I print out the value of the variable it tells me there is a secure string present but that doesn't seem to be the case in the actual DSC configuration itself.
If I change -SafeModeAdministratorPassword:$safemodepassword to include $using as I have with some of the other variables I get the error:
PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: Exception calling "Deserialize" with "1" argument(s): "The system cannot find the path specified.
I'm not sure where I can go from here. Any help would be appreciated. Thanks.
