-
Notifications
You must be signed in to change notification settings - Fork 54
Group: Unable to add Different forest User to Local Group #82
Description
I am running the following resource
Group AddUser
{
GroupName = "Administrators"
MembersToInclude = @("DOMAINB\USER1")
Credential = $DomainBCredential
Ensure = 'Present'
}
There are two forests with a single domain each, Computer1 is in domainA and user1 is in domainB. There is a full trust relationship between domains, it should be noted that NETBIOS name is not the same as FQDN on either forest.
I am attempting to add User1 to the local administrators group on Computer1. It should be noted that a number of additional users from domainA are already added into the Computer1 administrative user group via Group Policy, there are also a number of orphaned SIDs. This operation succeeds if done manually.
The credential is to another account on DomainB and has domain admin rights. When running the code I get the following error:
VERBOSE: [COMPUTERNAME]: [[Group]AddUser] Resolving DOMAINB in the Domain Admins domain.
Exception calling "FindByIdentity" with "3" argument(s): "The user name or password is
incorrect.
"
+ CategoryInfo : NotSpecified: (:) [], CimException
+ FullyQualifiedErrorId : COMException,ResolveSidToPrincipal
+ PSComputerName : COMPUTERNAME.DOMAINA.com
When running the exact same configuration using the xGroup resource the configuration resolves and runs correctly. All parameters where kept in memory so the actual username and password couldn't have had a typo. Unfortunately there is a secondary issue with xGroup which I'll post separately.