• Locked Locked
  • Replies 15 replies
  • Subscribers 62 subscribers
  • Views 16742 views
  • Users 0 members are here
Options
Related
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unable to execute powershell commands inside ARS scripts

Andrea.Giammaria
over 7 years ago

Hello,

I'm having issues with some powershell commands inside ARS script: I'm experiencing a very weird thing where my code doesn't get executed despite the debug log doesn't shows any error.

I'm attaching both my script and the debug log; i've also semplified the code so that just the essentials commands are left. The script basically does 3 things:

1. creates a local folder on a fixed path on the specified server
2. shares this folder on the root of the server
3. assigns the share to the newly created users.

function onPostCreate($Request) {

	$username = $Request.get("samaccountname")
	$server = $Request.get("edsva-servers")
	
	if (!$server) { 
		$server = 'S00V09951880'
	}
	
	$sharepath = '\\' + $server
	$localpath = 'D:\Users'
	
	# crea NT folder in path fisico
	New-Item -Name $username -ItemType Directory -Path $localpath
	
	# crea share
	net share "$username=$localpath\$username" "/GRANT:$username,CHANGE" "/GRANT:ITA\ITA data Manager,FULL"
	
	# assegna all'utente
	Set-QADUser $UserName -HomeDirectory "$sharepath\$username" -HomeDrive U: -proxy

}

WARNING: The names of some imported commands from the module 'ActiveRolesManagementShell' include unapproved verbs that might make them less discoverable. To find the commands with unapproved verbs, run the Import-Module command again with the Verbose parameter. For a list of approved verbs, type Get-Verb.
<-------------------------------------------------------------->
<----  New Debug Session  10/20/2016 11:21:21 AM ---->
<-------------------------------------------------------------->
<------------------- $Request  XML ------------------------>
 <CreateRequest xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" dn="CN=TEST lino 5566,OU=Provisioning,OU=Users & Clients,OU=SECOP1,OU=BNLSEC,DC=ita,DC=net,DC=intra" xmlns="urn:schemas-quest-com:ActiveRolesServer">
  <Attributes>
    <Attribute name="displayName" operation="Replace" type="String">
      <Values>
        <Value>TEST lino 5566</Value>
      </Values>
    </Attribute>
    <Attribute name="employeeID" operation="Replace" type="String">
      <Values>
        <Value>5566</Value>
      </Values>
    </Attribute>
    <Attribute name="givenName" operation="Replace" type="String">
      <Values>
        <Value>lino</Value>
      </Values>
    </Attribute>
    <Attribute name="objectClass" operation="Replace" type="String">
      <Values>
        <Value>user</Value>
      </Values>
    </Attribute>
    <Attribute name="sAMAccountName" operation="Replace" type="String">
      <Values>
        <Value>5566</Value>
      </Values>
    </Attribute>
    <Attribute name="sn" operation="Replace" type="String">
      <Values>
        <Value>TEST</Value>
      </Values>
    </Attribute>
    <Attribute name="userPrincipalName" operation="Replace" type="String">
      <Values>
        <Value>TEST.lino.5566@ita.net.intra</Value>
      </Values>
    </Attribute>
    <Attribute name="userAccountControl" operation="Replace" type="Integer">
      <Values>
        <Value>512</Value>
      </Values>
    </Attribute>
    <Attribute name="pwdLastSet" operation="Replace" type="LargeInteger">
      <Values>
        <Value>0</Value>
      </Values>
    </Attribute>
    <Attribute name="edsaPassword" operation="Replace" type="String" encrypted="true">
      <Values>
        <Value>**********</Value>
      </Values>
      <EncryptedValues>
        <Value>AQAAABGVTEKnt8tSzhNxpEvSKn6oF2yaAorjxRWL4WKsYBnl0kPTnpxg+sCptdcZcVyit9skEfiM
j/b9y2o23HXBqaSr5YLsN4k/BUt+1ZDiKSAfIGzxsDySfQkMwRz25Mgy6w==</Value>
      </EncryptedValues>
    </Attribute>
    <Attribute name="edsaNormalAccount" operation="Replace" type="Boolean">
      <Values>
        <Value>true</Value>
      </Values>
    </Attribute>
    <Attribute name="edsaUPNPrefix" operation="Replace" type="String">
      <Values>
        <Value>TEST.lino.5566</Value>
      </Values>
    </Attribute>
    <Attribute name="edsaUPNSuffix" operation="Replace" type="String">
      <Values>
        <Value>@ita.net.intra</Value>
      </Values>
    </Attribute>
    <Attribute name="edsva-OrgUnit" operation="Replace" type="String">
      <Values>
        <Value>ou=ATCENT,ou=RDVITA</Value>
      </Values>
    </Attribute>
    <Attribute name="edsva-Servers" operation="Replace" type="String">
      <Values>
        <Value>S00V09951880</Value>
      </Values>
    </Attribute>
    <Attribute name="edsvaUserMustChangePasswordAtNextLogon" operation="Replace" type="Boolean">
      <Values>
        <Value>true</Value>
      </Values>
    </Attribute>
    <Attribute name="edsaCreateMsExchMailbox" operation="Replace" type="Boolean">
      <Values>
        <Value>false</Value>
      </Values>
    </Attribute>
    <Attribute name="objectSid" operation="Replace" type="OctetString">
      <Values>
        <Value base64="true">AQUAAAAAAAUVAAAAU2idkVBaWJX/Gztb5xIDAA==</Value>
      </Values>
    </Attribute>
  </Attributes>
  <Controls>
    <Control id="13">
      <Values>
        <Value>ROMS000IM102.ita.net.intra</Value>
      </Values>
    </Control>
    <Control id="AllowApproval">
      <Values>
        <Value>Check</Value>
      </Values>
    </Control>
  </Controls>
</CreateRequest> 
 <------------------- $Request  XML ------------------------>
Call:  Set-PSDebug -trace 2
DEBUG:    1+  >>>> s4b84b5cc-c810-4775-9d48-9c0c512dec8e 'onPostCreate' $Request
DEBUG:     ! CALL function '<ScriptBlock>'
DEBUG:   23+   >>>> &$args[0] $args[1]

DEBUG:     ! CALL function '<ScriptBlock>'
DEBUG:    1+ function onPostCreate($Request)  >>>> {

DEBUG:     ! CALL function 'onPostCreate'
DEBUG:    3+  >>>> $username = $Request.get("samaccountname")

 Call method '$Request.Get'
     Arguments list:
         [1] : Value=samaccountname : Type=System.String
  Call '[PowerShellAttribute].Value'
  Call '[PowerShellAttribute].Value'
DEBUG:     ! SET $username = '5566'.
DEBUG:    4+  >>>> $server = $Request.get("edsva-servers")

 Call method '$Request.Get'
     Arguments list:
         [1] : Value=edsva-servers : Type=System.String
  Call '[PowerShellAttribute].Value'
  Call '[PowerShellAttribute].Value'
DEBUG:     ! SET $server = 'S00V09951880'.
DEBUG:    6+ if ( >>>> !$server) { 

DEBUG:   10+  >>>> $sharepath = '\\' + $server

DEBUG:     ! SET $sharepath = '\\S00V09951880'.
DEBUG:   11+  >>>> $localpath = 'D:\Users'

DEBUG:     ! SET $localpath = 'D:\Users'.
DEBUG:   14+  >>>> New-Item -Name $username -ItemType Directory -Path $localpath

DEBUG:   17+  >>>> net share "$username=$localpath\$username" "/GRANT:$username,CHANGE" "/GRANT:ITA\ITA data Manager,FULL"

DEBUG:   20+  >>>> Set-QADUser $UserName -HomeDirectory "$sharepath\$username" -HomeDrive U: -proxy

DEBUG:   22+  >>>> }

<------------------- $Request  XML ------------------------>
 <CreateRequest xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" dn="CN=TEST lino 5566,OU=Provisioning,OU=Users & Clients,OU=SECOP1,OU=BNLSEC,DC=ita,DC=net,DC=intra" xmlns="urn:schemas-quest-com:ActiveRolesServer">
  <Attributes>
    <Attribute name="displayName" operation="Replace" type="String">
      <Values>
        <Value>TEST lino 5566</Value>
      </Values>
    </Attribute>
    <Attribute name="employeeID" operation="Replace" type="String">
      <Values>
        <Value>5566</Value>
      </Values>
    </Attribute>
    <Attribute name="givenName" operation="Replace" type="String">
      <Values>
        <Value>lino</Value>
      </Values>
    </Attribute>
    <Attribute name="objectClass" operation="Replace" type="String">
      <Values>
        <Value>user</Value>
      </Values>
    </Attribute>
    <Attribute name="sAMAccountName" operation="Replace" type="String">
      <Values>
        <Value>5566</Value>
      </Values>
    </Attribute>
    <Attribute name="sn" operation="Replace" type="String">
      <Values>
        <Value>TEST</Value>
      </Values>
    </Attribute>
    <Attribute name="userPrincipalName" operation="Replace" type="String">
      <Values>
        <Value>TEST.lino.5566@ita.net.intra</Value>
      </Values>
    </Attribute>
    <Attribute name="userAccountControl" operation="Replace" type="Integer">
      <Values>
        <Value>512</Value>
      </Values>
    </Attribute>
    <Attribute name="pwdLastSet" operation="Replace" type="LargeInteger">
      <Values>
        <Value>0</Value>
      </Values>
    </Attribute>
    <Attribute name="edsaPassword" operation="Replace" type="String" encrypted="true">
      <Values>
        <Value>**********</Value>
      </Values>
      <EncryptedValues>
        <Value>AQAAABGVTEKnt8tSzhNxpEvSKn6oF2yaAorjxRWL4WKsYBnlmAtfDUk2gHlbFnHWfidlVgamqcCg
aeg2LtDeRxLR6rEKNwbG3yBpmBsAl49gOK+umZJtnmYHVUr/MZ1T5VPdWA==</Value>
      </EncryptedValues>
    </Attribute>
    <Attribute name="edsaNormalAccount" operation="Replace" type="Boolean">
      <Values>
        <Value>true</Value>
      </Values>
    </Attribute>
    <Attribute name="edsaUPNPrefix" operation="Replace" type="String">
      <Values>
        <Value>TEST.lino.5566</Value>
      </Values>
    </Attribute>
    <Attribute name="edsaUPNSuffix" operation="Replace" type="String">
      <Values>
        <Value>@ita.net.intra</Value>
      </Values>
    </Attribute>
    <Attribute name="edsva-OrgUnit" operation="Replace" type="String">
      <Values>
        <Value>ou=ATCENT,ou=RDVITA</Value>
      </Values>
    </Attribute>
    <Attribute name="edsva-Servers" operation="Replace" type="String">
      <Values>
        <Value>S00V09951880</Value>
      </Values>
    </Attribute>
    <Attribute name="edsvaUserMustChangePasswordAtNextLogon" operation="Replace" type="Boolean">
      <Values>
        <Value>true</Value>
      </Values>
    </Attribute>
    <Attribute name="edsaCreateMsExchMailbox" operation="Replace" type="Boolean">
      <Values>
        <Value>false</Value>
      </Values>
    </Attribute>
    <Attribute name="objectSid" operation="Replace" type="OctetString">
      <Values>
        <Value base64="true">AQUAAAAAAAUVAAAAU2idkVBaWJX/Gztb5xIDAA==</Value>
      </Values>
    </Attribute>
  </Attributes>
  <Controls>
    <Control id="13">
      <Values>
        <Value>ROMS000IM102.ita.net.intra</Value>
      </Values>
    </Control>
    <Control id="AllowApproval">
      <Values>
        <Value>Check</Value>
      </Values>
    </Control>
  </Controls>
</CreateRequest> 
 <------------------- $Request  XML ------------------------>


For an unknown reason task 2 and 3 are not completed even though from the debug log it seems that they have been executed.

The weirdest thing is that, the same exact code, is working like a charm inside my lab, but not at customer site.

Could you provide some enlightenment?

Thank you in advance,
Andrea

  • over 7 years ago
    For what it's worth, **if you have a home folder provisioning policy in place** (or are willing to consider using one), ARS provides another way to achieve the same thing as you are doing by way of just a SET-QADUser command:

    Here's some code:

    $NewHomeFolderPhyiscalPath = $localpath = 'D:\Users\' + $username

    $HomeShareName = $username

    # Setting of the virtual attribute cited below will force the creation of the home folder share in the location specified by the applicable home folder provisioning policy

    # It will also automatically update the home folder pointer on the AD object to reflect the share name

    set-qaduser -proxy -Identity $Username -HomeDirectory $NewHomeFolderPhysicalPath -HomeDrive 'U:' -ObjectAttributes @{edsvahomedirectorynetshare=$HomeShareName}
  • over 7 years ago
    As the exact same code works in a different environment I can only think its something underlying causing the problem. A bit long winded I know but I would suggest running the commands outside of AR on the same server as the AR service account and see if anything unexpected comes up that would throw AR.
  • over 7 years ago
    Thank you for your replies guys, i think i have found the problem cause: the slow AD's propagation.

    If i wait some minutes after the user's creation and then i execute my code, everything goes fine.

    I just modified the ARS domain configuration and now i'm pointing a DC with PDC Emulator Role, as suggested from one of the sysadmin here. Problem solved! Now the operations (user creation and homefolder's mapping) are working as expected and without any issue.

    Thank you,
    Andrea
  • over 7 years ago

    I agree with Ewan. We are seeing problems since installing AR7.0 console on the same machines as ARS6.9 console (we are preparing for a cutover).

    e.g.

    Connect-QADService -Service xxxxxx -Proxy

    The remote endpoint does not exist or could not be located.
    At line:1 char:1
    + Connect-QADService -Service xxxxxx -Proxy
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [Connect-QADService],
    COMException
    + FullyQualifiedErrorId :
    System.Runtime.InteropServices.COMException,Quest.ActiveRoles.ArsPowerShellSnapI
    n.Commands.ConnectCmdlet

  • over 7 years ago
    p.s. xxxxxx represents a valid ARS6.9 service.
  • over 7 years ago
    When you did your install, did you install the new ActiveRoles Powershell libraries as well?
  • over 7 years ago
    I did not do the actual installation. We utilize VM-based management consoles. I advised the team doing the installations as to the methodology, as far as I understand it, i.e.:
    -----------
    The software is available here:
    Z:<snip>\Dell\Active Roles\ActiveRoles 7.0\ActiveRoles 7.0\Setup.exe
    (Note that you only need install the "Console (MMC Interface)" item within above wizard; the "Management Tools" will be auto-selected as well)

    After the base installation, please install each of the patches, located nearby to above:
    ...\Dell\Active Roles\ActiveRoles 7.0\Patches\*.*
    (there are currently four patches)
    -----------
    And that's what they did, AFAIK.
  • over 7 years ago
    Where I am going with this is that I have seen this error where there is a mismatch between the "Quest cmdlets" version and the ActiveRoles version you are trying to connect to.

    The other thing you have to watch is if you are presenting credentials, you have to use Domain\User format and not User@domain.
  • over 7 years ago
    Thanks JQ.

    Still nothing obvious here, though - we're connecting to the (current Production) ARS6.9 host(s) after logging in with Domain\User to the workstation (and subsequently just running PowerShell console). Simple stuff that was working fine prior to installing AR7.0 on the workstation(s). I have not attempted to connect to the AR7.0 backend yet. In fact, that service is not running for 99.9% of the time as we are still doing pre-migration testing.

    Of course, we'd like the CMDLETS to work just fine with ARS6.9, as they had been as recently as last week.
  • over 7 years ago
    Active Roles 7.0 requires that all clients be able to connect to the server on port 15172. Can you check to see if this port is accessible from the client machines?