PowerShell DSC：错误 22 使用证书加密服务资源中的凭据答案

【问题标题】：PowerShell DSC: Error 22 using certs to encrypt creds in a Service ResourcePowerShell DSC：错误 22 使用证书加密服务资源中的凭据
【发布时间】：2015-03-31 05:25:25
【问题描述】：

我正在尝试使用证书将凭据嵌入到服务资源中。我在基础设施中安装了 PKI，并且我的所有测试服务器都是自动注册的。我在本地导出了他们的证书以供使用，并将它们放在我的 ConfigData 中，如下所示：

@{
    AllNodes = @(

    @{
        NodeName = "*"
        NeoConfigDestinationPath = "D:\ServerBox\Servers\JRun4\_build\shared\config"
    }

    @{
        NodeName = 'DEVOPS'
        Role = @('DSCPullServer')
        CertificateFile = "D:\EQ_DSCModule\Certs\DEVOPS.cer"
        Thumbprint = "AE4F10AE4141C8726EEEBE888C69FE7ABB3099A8"
    }

    @{
        NodeName = 'Server1'
        Role = @('IIS', 'ServerBox', 'DevInt')
        CFServices = @("Adobe CF9 1", "Adobe CF9 2", "Adobe CF9 3", "Adobe CF9 4")
        CertificateFile = "D:\EQ_DSCModule\Certs\Client1.cer"
        Thumbprint = "4FA343A76AEA2B805850190E9C04AA9E2A82A162"
    }

    @{
        NodeName = 'Server2'
        Role = @('IIS', 'ServerBox', 'DevInt')
        CFServices = @("Adobe CF9 1")
        CertificateFile = "D:\EQ_DSCModule\Certs\Client2.cer"
        Thumbprint = "0FCB76684F0C74495DEB54F637B50BDA7182483D"
    }

    )

    ServerBoxConfig = @{
        SourcePath = "\\Share\Path\DevOps\ServerBox"
        DestinationPath = "D:\ServerBox"
    }

    DevIntConfig = @{
        SourcePath = "\\Share\Path\DevOps\DevInt"
        DestinationPath = "D:\ServerBox\IIS\wwwroot"
        NeoConfigSourcePath = "\\Share\Path\DevOps\ServerConfig\Environments\DevInt\NeoConfig"
    }
}

这是我正在运行的配置脚本：

$webCFDevCred = Get-Credential -Credential "svc-webcfdev@domain.com"

Configuration EqConfig
{

    Import-DSCResource -Module xPSDesiredStateConfiguration
    Import-DSCResource -Module cChoco

    Node $AllNodes.NodeName {

        cChocoInstaller installChoco {
            InstallDir = "C:\ProgramData\Chocolatey"
        }

    }

    Node $AllNodes.Where({ $_.role -eq 'DSCPullServer' }).NodeName { ... } #DSCPullServer

    Node $AllNodes.Where({ $_.role -eq 'IIS' }).NodeName { ... } #IIS

    Node $AllNodes.Where({ $_.role -eq 'ServerBox' }).NodeName {

        File ServerBox
        {
            Ensure = "Present"
            Type = "Directory"
            Recurse = $true
            MatchSource = $true
            Force = $true
            Checksum = "modifiedDate"
            SourcePath = $ConfigurationData.ServerBoxConfig.SourcePath
            DestinationPath = $ConfigurationData.ServerBoxConfig.DestinationPath
        }

    } #ServerBox

    Node $AllNodes.Where({ $_.role -eq 'DevInt' }).NodeName {

        File DevInt
        {
            Ensure = "Present"
            Type = "Directory"
            Recurse = $true
            MatchSource = $true
            Force = $true
            Checksum = "modifiedDate"
            SourcePath = $ConfigurationData.DevIntConfig.SourcePath
            DestinationPath = $ConfigurationData.DevIntConfig.DestinationPath
            DependsOn = "[File]ServerBox"
        }

        File DevInt_Config
        {
            Ensure = "Present"
            Type = "Directory"
            MatchSource = $true
            Force = $true
            Checksum = "modifiedDate"
            SourcePath = $ConfigurationData.DevIntConfig.NeoConfigSourcePath
            DestinationPath = $Node.NeoConfigDestinationPath
            DependsOn = "[File]ServerBox"
        }

        #This runs a script to build out the ColdFusion cluster/servers
        #Uses the number of services as the param for serverCount
        cChocoPackageInstaller installServerBox {
            Name = "ServerBox.DevInt -params $($Node.CFServices.Length)"
            DependsOn = @("[cChocoInstaller]installChoco", "[File]DevInt_Config")
        }

        #Sets the services generated by the ServerBox script
        $Node.CFServices.ForEach({
            Service "Service-$_" {
                Name = $_
                State = 'Running'
                Credential = $webCFDevCred
                DependsOn = "[cChocoPackageInstaller]installServerBox"
            }
        })

    } #DevInt

} #Configuration

EqConfig -ConfigurationData .\EQConfigData.psd1 -Output .\EqConfig -Verbose

Function Get-ComputerGuid
{
    param (
        [Parameter(Mandatory = $true)]
        [string]$ComputerName
    )
    process
    {
        ([guid]([adsisearcher]"(samaccountname=$ComputerName`$)").FindOne().Properties["objectguid"][0]).Guid
    }
}

$DSCPullFolder = "C:\Program Files\WindowsPowerShell\DscService\Configuration"

Get-ChildItem .\EqConfig\* -Filter *.mof | ForEach-Object {
    $guidMofFile = "$DSCPullFolder\$(Get-ComputerGuid $_.BaseName).mof"
    $newMof = copy $_.FullName $guidMofFile -PassThru -Force
    $newHash = (Get-FileHash $newMof).hash
    [System.IO.File]::WriteAllText("$newMof.checksum", $newHash)
}

Configuration EqLocalConfig
{
    Node $AllNodes.NodeName {
        LocalConfigurationManager {
            AllowModuleOverwrite = 'True'
            CertificateID = $Node.Thumbprint
            ConfigurationID = $(Get-ComputerGuid $nodeName)
            ConfigurationModeFrequencyMins = 15
            ConfigurationMode = 'ApplyAndAutoCorrect'
            RebootNodeIfNeeded = 'True'
            RefreshMode = 'PULL'
            DownloadManagerName = 'WebDownloadManager'
            DownloadManagerCustomData = (@{ ServerUrl = "https://DEVOPS:443/psdscpullserver.svc" })
        }
    }
}

EqLocalConfig -ConfigurationData .\EQConfigData.psd1 -Verbose

Set-DscLocalConfigurationManager -Path .\EqLocalConfig -Verbose

据我所知，它应该可以工作。我的 MOF 是在内部使用加密密码生成的，但是当客户端服务器获取配置并进入服务步骤时，它会出错。检查事件查看器，这是事件的详细信息：

"此事件表示LCM处理配置失败。ErrorId是0x1。ErrorDetail是SendConfigurationApply函数没有成功。ResourceId是[Service]Service-Adobe CF9 1，SourceInfo是D:\EQ_DSCModule\EqConfig .ps1::285::4::Service。ErrorMessage 是 PowerShell 提供程序 MSFT_ServiceResource 无法执行 Set-TargetResource 功能并出现错误消息：无法更改“凭据”属性。消息：“Win32_Service”的“更改”方法失败错误代码：“22”。。”

根据 MSDN (https://msdn.microsoft.com/en-us/library/aa384901%28v=vs.85%29.aspx) Change 方法上的错误代码 22 表示“运行此服务的帐户无效或缺少运行该服务的权限。”我知道服务帐户工作正常，我可以使用 WMI 自己添加它，如下所示：

For ($i=0; $i -lt $clusterCount; $i++) {
    (Get-WmiObject -Query "SELECT * FROM Win32_Service WHERE Name = 'Adobe CF9 $($i+1)'").Change($null,$null,$null,$null,$null,$null,'svc-webcfdev@domain.com','password',$null,$null,$null)
}

所以如果我可以使用 WMI 添加帐户，DSC 应该也可以，对吗？啊！

想法？

【问题讨论】：

额外说明一下，我尝试过使用明文密码，但在运行 Change 方法时服务资源仍然会抛出错误 22，但当我自己运行它时它很好。
我还将自己的凭据注入到 LCM 中，因此它像我一样运行脚本，但错误仍然存在。

标签： powershell certificate credentials dsc

【解决方案1】：

当您同时使用证书文件和指纹 (certificateid) 时，证书文件将发生加密，但只有您输入的指纹 (certificateid) 会写入 .mof 文件。他们很容易失去同步。作为测试尝试将证书添加到本地机器存储，然后从脚本中删除对证书文件的引用。如果找不到证书，请重新生成并修复任何问题。看看这是否能解决问题。

【讨论】：