ADDomainController: MSFT_ADDomainController failed to execute Test-TargetResource functionality with error message: System.Exception: Current node could not find the domain #673

jquinn99002 · 2022-03-10T13:46:02Z

Details of the scenario you tried and the problem that is occurring

I have 2 x VM's in Azure and I am using Azure Automation DSC to apply two DSC Configurations, one to each VM.

DC01 has the DomainController.Primary config applied to it and this works fine.

DC02 has the DomainController.Additional config applied to it...
If this is applied at the same time as DC01 having DomainController.Primary, then DomainController.Additional completes without any issue.
But if DomainController.Additional is applied at a later time, then it works fine until it reaches ADDomainController AdditionalDc
When it is applying ADDomainController AdditionalDc, it does promote it to be a DC, but after the automatic reboot, I get the error: MSFT_ADDomainController failed to execute Test-TargetResource functionality with error message: System.Exception: Current node could not find the domain (full logs below)

When the DSC Config next runs though, it all goes through fine, so I think the issue is to do with the DSC trying to contain the domain before it is able to (throughout this whole time, the primary domain should be contactable on DC01)

Verbose logs showing the problem

VERBOSE: [2022-03-10 12:45:20Z] [WARNING] [dc02]: [[ADDomainController]AdditionalDc]
This computer has at least one physical network adapter that does not have static IP address(es) assigned to its IP
Properties. If both IPv4 and IPv6 are enabled for a network adapter, both IPv4 and IPv6 static IP addresses should be
assigned to both IPv4 and IPv6 Properties of the physical network adapter. Such static IP address(es) assignment should
be done to all the physical network adapters for reliable Domain Name System (DNS) operation.

VERBOSE: [2022-03-10 12:45:22Z] [WARNING] [dc02]: [[ADDomainController]AdditionalDc] A
delegation for this DNS server cannot be created because the authoritative parent zone cannot be found or it does not
run Windows DNS server. If you are integrating with an existing DNS infrastructure, you should manually create a
delegation to this DNS server in the parent zone to ensure reliable name resolution from outside the domain
"mydomain.local". Otherwise, no action is required.

VERBOSE: [2022-03-10 12:45:22Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] ----------------------------------------
VERBOSE: [2022-03-10 12:45:22Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] The following actions will be performed:
VERBOSE: [2022-03-10 12:45:22Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc]
Configure this server as an additional Active Directory domain controller for the domain "mydomain.local".
Site:
Additional Options:
Read-only domain controller: "No"
Global catalog: Yes
DNS Server: Yes
Update DNS Delegation: No
Source DC: dc01.mydomain.local
Database folder: C:\Windows\NTDS
Log file folder: C:\Windows\NTDS
SYSVOL folder: C:\Windows\SYSVOL
The DNS Server service will be installed on this computer.
The DNS Server service will be configured on this computer.
This computer will be configured to use this DNS server as its preferred DNS server.

VERBOSE: [2022-03-10 12:45:22Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] ----------------------------------------
VERBOSE: [2022-03-10 12:45:22Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] Active Directory Domain Services Setup
VERBOSE: [2022-03-10 12:45:22Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] Validating environment and parameters...
VERBOSE: [2022-03-10 12:45:23Z] [WARNING] [dc02]: [[ADDomainController]AdditionalDc]
Windows Server 2019 domain controllers have a default for the security setting named "Allow cryptography algorithms
compatible with Windows NT 4.0" that prevents weaker cryptography algorithms when establishing security channel
sessions.
For more information about this setting, see Knowledge Base article 942564
(http://go.microsoft.com/fwlink/?LinkId=104751).

VERBOSE: [2022-03-10 12:45:23Z] [WARNING] [dc02]: [[ADDomainController]AdditionalDc]
This computer has at least one physical network adapter that does not have static IP address(es) assigned to its IP
Properties. If both IPv4 and IPv6 are enabled for a network adapter, both IPv4 and IPv6 static IP addresses should be
assigned to both IPv4 and IPv6 Properties of the physical network adapter. Such static IP address(es) assignment should
be done to all the physical network adapters for reliable Domain Name System (DNS) operation.

VERBOSE: [2022-03-10 12:45:25Z] [WARNING] [dc02]: [[ADDomainController]AdditionalDc] A
delegation for this DNS server cannot be created because the authoritative parent zone cannot be found or it does not
run Windows DNS server. If you are integrating with an existing DNS infrastructure, you should manually create a
delegation to this DNS server in the parent zone to ensure reliable name resolution from outside the domain
"mydomain.local". Otherwise, no action is required.

VERBOSE: [2022-03-10 12:45:26Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] ----------------------------------------
VERBOSE: [2022-03-10 12:45:26Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] The following actions will be performed:
VERBOSE: [2022-03-10 12:45:26Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc]
Configure this server as an additional Active Directory domain controller for the domain "mydomain.local".
Site:
Additional Options:
Read-only domain controller: "No"
Global catalog: Yes
DNS Server: Yes
Update DNS Delegation: No
Source DC: dc01.mydomain.local
Database folder: C:\Windows\NTDS
Log file folder: C:\Windows\NTDS
SYSVOL folder: C:\Windows\SYSVOL
The DNS Server service will be installed on this computer.
The DNS Server service will be configured on this computer.
This computer will be configured to use this DNS server as its preferred DNS server.

VERBOSE: [2022-03-10 12:45:26Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] ----------------------------------------
VERBOSE: [2022-03-10 12:45:26Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] Press CTRL-C to: Cancel
VERBOSE: [2022-03-10 12:46:16Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] Press CTRL-C to: Finish Replication Later
VERBOSE: [2022-03-10 12:46:16Z] Settings handler status to 'transitioning' (C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\Status\0.status)
VERBOSE: [2022-03-10 12:48:50Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc]
Active Directory Domain Services is now installed on this computer for the domain "mydomain.local".
This Active Directory domain controller is assigned to the site "Default-First-Site-Name". You can manage sites with
the Active Directory Sites and Services administrative tool.

VERBOSE: [2022-03-10 12:48:50Z] Settings handler status to 'transitioning' (C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\Status\0.status)
VERBOSE: [2022-03-10 12:48:51Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] The current node 'dc02' has been promoted to a domain controller for the domain 'mydomain.local'. (ADDC0010)
VERBOSE: [2022-03-10 12:48:51Z] [VERBOSE] [dc02]: LCM: [ End Set ] [[ADDomainController]AdditionalDc] in 212.5600 seconds.
VERBOSE: [2022-03-10 12:48:51Z] [VERBOSE] [dc02]: LCM: [ End Resource ] [[ADDomainController]AdditionalDc]
VERBOSE: [2022-03-10 12:48:51Z] [VERBOSE] [dc02]: [] A reboot is required to progress further. Please reboot the system. Configuration will not be continued after the reboot. To continue configuration, use Start-DscConfiguration -UseExisting after reboot.
VERBOSE: [2022-03-10 12:48:51Z] [WARNING] [dc02]: [] A reboot is required to progress further. Please reboot the system. Configuration will not be continued after the reboot. To continue configuration, use Start-DscConfiguration -UseExisting after reboot.
VERBOSE: [2022-03-10 12:48:51Z] [VERBOSE] Operation 'Invoke CimMethod' complete.
VERBOSE: [2022-03-10 12:48:51Z] [VERBOSE] Time taken for configuration job to complete is 880.278 seconds
VERBOSE: [2022-03-10 12:48:52Z] Settings handler status to 'transitioning' (C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\Status\0.status)
VERBOSE: [2022-03-10 12:48:52Z] Updating execution status (HKLM:\SOFTWARE\Microsoft\Azure\DSC\2.77.0.0\Status)
VERBOSE: [2022-03-10 12:48:52Z] LCM state is PendingReboot
VERBOSE: [2022-03-10 12:48:52Z] A reboot is required by the configuration. Rebooting...
VERBOSE: [2022-03-10 12:48:52Z] Settings handler status to 'transitioning' (C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\Status\0.status)
VERBOSE: [2022-03-10 12:48:52Z] Updating execution status (HKLM:\SOFTWARE\Microsoft\Azure\DSC\2.77.0.0\Status)
VERBOSE: [2022-03-10 12:48:52Z] Getting handler execution status HKLM:\SOFTWARE\Microsoft\Azure\DSC\2.77.0.0\Status ...
VERBOSE: [2022-03-10 12:48:52Z] Releasing SameSeq mutex
VERBOSE: [2022-03-10 12:48:52Z] Releasing mutex DscExtensionHandler_Lock

***************************************************************************************** AUTOMATIC REBOOT BY DSC *****************************************************************************************

VERBOSE: [2022-03-10 12:49:51Z] Extension request for sequence number 0 attempting to create lock.0 mutex
VERBOSE: [2022-03-10 12:49:51Z] Attempting to grab mutex DscExtensionHandler_Lock for sequence number 0
VERBOSE: [2022-03-10 12:49:51Z] Acquired lock for extension instance for sequence number 0
VERBOSE: [2022-03-10 12:49:51Z] Attempting to acquire extension lock
VERBOSE: [2022-03-10 12:49:51Z] Attempting to grab mutex DscExtensionHandler_Lock
VERBOSE: [2022-03-10 12:49:51Z] Acquired lock for extension
VERBOSE: [2022-03-10 12:49:51Z] lock does not exist: begin processing
VERBOSE: [2022-03-10 12:49:51Z] Starting DSC Extension ...
VERBOSE: [2022-03-10 12:49:51Z] Getting handler execution status HKLM:\SOFTWARE\Microsoft\Azure\DSC\2.77.0.0\Status ...
VERBOSE: [2022-03-10 12:49:52Z] Getting handler execution status HKLM:\SOFTWARE\Microsoft\Azure\DSC\2.77.0.0\Status ...
VERBOSE: [2022-03-10 12:49:52Z] Reading handler settings from C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\RuntimeSettings\0.settings
VERBOSE: [2022-03-10 12:49:52Z] Found protected settings on Azure VM. Decrypting.
VERBOSE: [2022-03-10 12:49:58Z] Getting handler execution status HKLM:\SOFTWARE\Microsoft\Azure\DSC\2.77.0.0\Status ...
VERBOSE: [2022-03-10 12:49:58Z] Getting handler execution status HKLM:\SOFTWARE\Microsoft\Azure\DSC\2.77.0.0\Status ...
VERBOSE: [2022-03-10 12:49:58Z] Updating execution status (HKLM:\SOFTWARE\Microsoft\Azure\DSC\2.77.0.0\Status)
VERBOSE: [2022-03-10 12:49:58Z] Settings handler status to 'transitioning' (C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\Status\0.status)
VERBOSE: [2022-03-10 12:49:58Z] Will continue the existing configuration. Executing Start-DscConfiguration with -UseExisting option ...
VERBOSE: [2022-03-10 12:49:59Z] Settings handler status to 'transitioning' (C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\Status\0.status)
VERBOSE: [2022-03-10 12:50:03Z] [VERBOSE] Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = ApplyConfiguration,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: [2022-03-10 12:50:03Z] [VERBOSE] An LCM method call arrived from computer dc02 with user sid S-1-5-18.
VERBOSE: [2022-03-10 12:50:03Z] [VERBOSE] [dc02]: [] Starting consistency engine.
VERBOSE: [2022-03-10 12:50:03Z] [VERBOSE] [dc02]: [] A pending configuration exists. DSC will process a set request on the pending configuration.
VERBOSE: [2022-03-10 12:50:03Z] [VERBOSE] [dc02]: LCM: [ Start Resource ] [[WindowsFeature]ADDSInstall]
VERBOSE: [2022-03-10 12:50:03Z] [VERBOSE] [dc02]: LCM: [ Start Test ] [[WindowsFeature]ADDSInstall]
VERBOSE: [2022-03-10 12:50:04Z] [VERBOSE] [dc02]: [[WindowsFeature]ADDSInstall] The operation 'Get-WindowsFeature' started: AD-Domain-Services
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: [[WindowsFeature]ADDSInstall] The operation 'Get-WindowsFeature' succeeded: AD-Domain-Services
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ End Test ] [[WindowsFeature]ADDSInstall] in 17.1100 seconds.
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ Skip Set ] [[WindowsFeature]ADDSInstall]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ End Resource ] [[WindowsFeature]ADDSInstall]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ Start Resource ] [[WindowsFeature]ADDSTools]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ Start Test ] [[WindowsFeature]ADDSTools]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: [[WindowsFeature]ADDSTools] The operation 'Get-WindowsFeature' started: RSAT-ADDS
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: [[WindowsFeature]ADDSTools] The operation 'Get-WindowsFeature' succeeded: RSAT-ADDS
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ End Test ] [[WindowsFeature]ADDSTools] in 0.3440 seconds.
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ Skip Set ] [[WindowsFeature]ADDSTools]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ End Resource ] [[WindowsFeature]ADDSTools]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ Start Resource ] [[WindowsFeature]InstallRSAT-AD-PowerShell]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ Start Test ] [[WindowsFeature]InstallRSAT-AD-PowerShell]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: [[WindowsFeature]InstallRSAT-AD-PowerShell] The operation 'Get-WindowsFeature' started: RSAT-AD-PowerShell
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: [[WindowsFeature]InstallRSAT-AD-PowerShell] The operation 'Get-WindowsFeature' succeeded: RSAT-AD-PowerShell
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ End Test ] [[WindowsFeature]InstallRSAT-AD-PowerShell] in 0.2650 seconds.
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ Skip Set ] [[WindowsFeature]InstallRSAT-AD-PowerShell]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ End Resource ] [[WindowsFeature]InstallRSAT-AD-PowerShell]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ Start Resource ] [[WaitForADDomain]DscForestWait]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: LCM: [ Start Test ] [[WaitForADDomain]DscForestWait]
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] Determining the current state of the Active Directory domain 'mydomain.local'. (WFADD0013)
VERBOSE: [2022-03-10 12:50:21Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] Searching for a domain controller in the domain 'mydomain.local'. (WFADD0001)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] Impersonating the credentials 'mydomain.local\DCAdmin' when looking for a domain controller. (WFADD0011)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] Searching for a domain controller in the domain 'mydomain.local'. (ADCOMMON0052)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] The type 'System.DirectoryServices.ActiveDirectory.DirectoryContext' is already loaded into the PowerShell session. (ADCOMMON0043)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] Get a new Active Directory context of the type 'Domain'. (ADCOMMON0046)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] The Active Directory context will target 'mydomain.local'. (ADCOMMON0047)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] The Active Directory context will be accessed using the 'mydomain.local\DCAdmin' credentials. (ADCOMMON0048)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] Found a domain controller in the domain 'mydomain.local'. (ADCOMMON0049)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] Found domain controller. (WFADD0009)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] Evaluating the state of the property 'IsAvailable'. (ADCOMMON0003)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] The parameter 'IsAvailable' is in desired state. (ADCOMMON0004)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[WaitForADDomain]DscForestWait] Domain 'mydomain.local' is in the desired state. (WFADD0006)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: LCM: [ End Test ] [[WaitForADDomain]DscForestWait] in 0.6090 seconds.
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: LCM: [ Skip Set ] [[WaitForADDomain]DscForestWait]
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: LCM: [ End Resource ] [[WaitForADDomain]DscForestWait]
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: LCM: [ Start Resource ] [[ADDomainController]AdditionalDc]
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: LCM: [ Start Test ] [[ADDomainController]AdditionalDc]
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] Determine the state of the domain controller on the current node 'dc02' in the domain 'mydomain.local'. (ADDC0015)
VERBOSE: [2022-03-10 12:50:22Z] [VERBOSE] [dc02]: [[ADDomainController]AdditionalDc] Resolving the domain name 'mydomain.local'. (ADDC0001)
VERBOSE: [2022-03-10 12:50:23Z] [VERBOSE] [dc02]: LCM: [ End Test ] [[ADDomainController]AdditionalDc] in 0.7030 seconds.
VERBOSE: [2022-03-10 12:50:23Z] [ERROR] PowerShell DSC resource MSFT_ADDomainController failed to execute
Test-TargetResource functionality with error message: System.Exception: Current node could not find the domain
'mydomain.local'. (ADDC0008) ---> System.Security.Authentication.AuthenticationException: Either the target name is
incorrect or the server has rejected the client credentials. --->
System.ServiceModel.Security.SecurityNegotiationException: Either the target name is incorrect or the server has
rejected the client credentials. ---> System.Security.Authentication.InvalidCredentialException: Either the target name
is incorrect or the server has rejected the client credentials. ---> System.ComponentModel.Win32Exception: The logon
attempt failed
--- End of inner exception stack trace ---
at System.Net.Security.NegoState.StartSendAuthResetSignal(LazyAsyncResult lazyResult, Byte[] message, Exception exception)
at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult)
at System.Net.Security.NegoState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential credential, String targetName, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel)
at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeInitiator.OnInitiateUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity)
--- End of inner exception stack trace ---

Server stack trace:
at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeInitiator.OnInitiateUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity)
at System.ServiceModel.Channels.StreamSecurityUpgradeInitiatorBase.InitiateUpgrade(Stream stream)
at System.ServiceModel.Channels.ConnectionUpgradeHelper.InitiateUpgrade(StreamUpgradeInitiator upgradeInitiator, IConnection& connection, ClientFramingDecoder decoder, IDefaultCommunicationTimeouts defaultTimeouts, TimeoutHelper& timeoutHelper)
at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.SendPreamble(IConnection connection, ArraySegment`1 preamble, TimeoutHelper& timeoutHelper)
at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.DuplexConnectionPoolHelper.AcceptPooledConnection(IConnection connection, TimeoutHelper& timeoutHelper)
at System.ServiceModel.Channels.ConnectionPoolHelper.EstablishConnection(TimeSpan timeout)
at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.OnOpen(TimeSpan timeout)
at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)
at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannel.CallOpenOnce.System.ServiceModel.Channels.ServiceChannel.ICallOnce.Call(ServiceChannel channel, TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade)
at System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Exception rethrown at [0]:
at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
at Microsoft.ActiveDirectory.WebServices.Proxy.Resource.Get(Message request)
at Microsoft.ActiveDirectory.Management.AdwsConnection.SearchAnObject(ADSearchRequest request)
--- End of inner exception stack trace ---

at Microsoft.ActiveDirectory.Management.AdwsConnection.ThrowAuthenticationRelatedExceptionIfAny(CommunicationException exception)
at Microsoft.ActiveDirectory.Management.AdwsConnection.SearchAnObject(ADSearchRequest request)
at Microsoft.ActiveDirectory.Management.AdwsConnection.Search(ADSearchRequest request)
at Microsoft.ActiveDirectory.Management.ADWebServiceStoreAccess.Microsoft.ActiveDirectory.Management.IADSyncOperations.Search(ADSessionHandle handle, ADSearchRequest request)
at Microsoft.ActiveDirectory.Management.ADObjectSearcher.GetRootDSE()
at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase1.GetRootDSE() at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase1.GetConnectedStore()
at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase1.GetCmdletSessionInfo() at Microsoft.ActiveDirectory.Management.Commands.ADGetCmdletBase3.ADGetCmdletBaseProcessCSRoutine()
at Microsoft.ActiveDirectory.Management.CmdletSubroutinePipeline.Invoke()
at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase`1.ProcessRecord()

--- End of inner exception stack trace ---
VERBOSE: [2022-03-10 12:50:23Z] [VERBOSE] [dc02]: [] Consistency check completed.
VERBOSE: [2022-03-10 12:50:23Z] [ERROR] The SendConfigurationApply function did not succeed. LCM failed to start desired state configuration manually.
VERBOSE: [2022-03-10 12:50:23Z] [VERBOSE] Operation 'Invoke CimMethod' complete.
VERBOSE: [2022-03-10 12:50:23Z] [VERBOSE] Time taken for configuration job to complete is 20.665 seconds
VERBOSE: [2022-03-10 12:50:24Z] Settings handler status to 'transitioning' (C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\Status\0.status)
VERBOSE: [2022-03-10 12:50:25Z] LCM state is PendingConfiguration
VERBOSE: [2022-03-10 12:51:25Z] DSC configuration completed.
VERBOSE: [2022-03-10 12:51:25Z] Resetting metaconfiguration...
VERBOSE: [2022-03-10 12:51:25Z] Restoring C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\DSCWork\RegistrationMetaConfigV2.0\RegistrationMetaConfigV2\localhost.meta.mof.bk...
VERBOSE: [2022-03-10 12:51:25Z] Executing Set-DscLocalConfigurationManager...
VERBOSE: [2022-03-10 12:51:26Z] Settings handler status to 'transitioning' (C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\Status\0.status)
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] Performing the operation "Start-DscConfiguration: SendMetaConfigurationApply" on target "MSFT_DSCLocalConfigurationManager".
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = SendMetaConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] An LCM method call arrived from computer dc02 with user sid S-1-5-18.
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] [dc02]: LCM: [ Start Set ]
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] [dc02]: LCM: [ Start Resource ] [MSFT_DSCMetaConfiguration]
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] [dc02]: LCM: [ Start Set ] [MSFT_DSCMetaConfiguration]
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] [dc02]: LCM: [ End Set ] [MSFT_DSCMetaConfiguration] in 0.0310 seconds.
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] [dc02]: LCM: [ End Resource ] [MSFT_DSCMetaConfiguration]
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] [dc02]: LCM: [ End Set ]
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] [dc02]: LCM: [ End Set ] in 0.1250 seconds.
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] Operation 'Invoke CimMethod' complete.
VERBOSE: [2022-03-10 12:51:28Z] [VERBOSE] Set-DscLocalConfigurationManager finished in 0.814 seconds.
VERBOSE: [2022-03-10 12:51:29Z] Settings handler status to 'transitioning' (C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\Status\0.status)
VERBOSE: [2022-03-10 12:51:30Z] Get-DscLocalConfigurationManager:
ActionAfterReboot : ContinueConfiguration
AgentId : 4099BCEB-A06E-11EC-983A-002248398501
AllowModuleOverWrite : False
CertificateID : 7A2E3912E929D7B1DEB152AD198B674936E862EA
ConfigurationDownloadManagers : {[ConfigurationRepositoryWeb]AzureAutomationDSC}
ConfigurationID :
ConfigurationMode : ApplyAndMonitor
ConfigurationModeFrequencyMins : 15
Credential :
DebugMode : {NONE}
DownloadManagerCustomData :
DownloadManagerName :
LCMCompatibleVersions : {1.0, 2.0}
LCMState : PendingConfiguration
LCMStateDetail :
LCMVersion : 2.0
StatusRetentionTimeInDays : 10
SignatureValidationPolicy : NONE
SignatureValidations : {}
MaximumDownloadSizeMB : 500
PartialConfigurations :
RebootNodeIfNeeded : True
RefreshFrequencyMins : 30
RefreshMode : Pull
ReportManagers : {[ReportServerWeb]AzureAutomationDSC}
ResourceModuleManagers : {[ResourceRepositoryWeb]AzureAutomationDSC}
PSComputerName :

VERBOSE: [2022-03-10 12:51:30Z] Settings handler status to 'error' (C:\Packages\Plugins\Microsoft.Powershell.DSC\2.77.0.0\Status\0.status)
VERBOSE: [2022-03-10 12:51:30Z] Loading VM agent telemetry assemblies ...
VERBOSE: [2022-03-10 12:51:30Z] [ERROR] while enabling MDS telemetry... [MDS Telemetry] C:\WindowsAzure\GuestAgent_2.7.41491.1044_2022-03-10_125121\WindowsAzureEventSource.dll does not exist ...
VERBOSE: [2022-03-10 12:51:30Z] Getting handler execution status HKLM:\SOFTWARE\Microsoft\Azure\DSC\2.77.0.0\Status ...
VERBOSE: [2022-03-10 12:51:30Z] Updating execution status (HKLM:\SOFTWARE\Microsoft\Azure\DSC\2.77.0.0\Status)
VERBOSE: [2022-03-10 12:51:30Z] Transitioning to Completed state ...
VERBOSE: [2022-03-10 12:51:30Z] Releasing SameSeq mutex
VERBOSE: [2022-03-10 12:51:30Z] Releasing mutex DscExtensionHandler_Lock

The DSC configuration that is used to reproduce the issue (as detailed as possible)

Configuration DomainController
{
    Import-DSCResource -ModuleName StorageDsc
    Import-DscResource -ModuleName ActiveDirectoryDsc
    Import-DscResource –ModuleName PSDesiredStateConfiguration

    $DomainName      = Get-AutomationVariable -Name "DomainName"        # mydomain.local
    $domainCred      = Get-AutomationPSCredential -Name "DomainAdmin"   # Credential for DCAdmin
    $DomainAdminDN   = Get-AutomationPSCredential -Name "DomainAdminDN" # Credential for mydomain.local\DCAdmin
    $DomainAdminSafe = Get-AutomationPSCredential -Name "DomainAdminSafe"

    Node "Primary"
    {
        WindowsFeature ADDSInstall
        {
            Ensure    = "Present"
            Name      = "AD-Domain-Services"
        }
        WindowsFeature ADDSTools
        {
            Ensure    = "Present"
            Name      = "RSAT-ADDS"
            DependsOn = "[WindowsFeature]ADDSInstall"
        }
        WindowsFeature InstallRSAT-AD-PowerShell
        {
            Ensure    = "Present"
            Name      = "RSAT-AD-PowerShell"
            DependsOn = "[WindowsFeature]ADDSTools"
        }        
        ADDomain FirstDS
        {
            DomainName                    = $DomainName
            Credential                    = $domainCred
            SafemodeAdministratorPassword = $DomainAdminSafe
            ForestMode                    = 'Win2012R2'
            DependsOn                     = "[WindowsFeature]ADDSInstall"
        }
    }
    Node "Additional"
    {
        WindowsFeature ADDSInstall
        {
            Ensure    = "Present"
            Name      = "AD-Domain-Services"
        }
        WindowsFeature ADDSTools
        {
            Ensure    = "Present"
            Name      = "RSAT-ADDS"
            DependsOn = "[WindowsFeature]ADDSInstall"
        }
        WindowsFeature InstallRSAT-AD-PowerShell
        {
            Ensure    = "Present"
            Name      = "RSAT-AD-PowerShell"
            DependsOn = "[WindowsFeature]ADDSTools"
        }
        WaitForADDomain DscForestWait
        {
            DomainName              = $DomainName
            Credential              = $DomainAdminDN
            WaitTimeout             = 900
            RestartCount            = 2
            WaitForValidCredentials = $True
            DependsOn               = "[WindowsFeature]ADDSInstall"
        }
        ADDomainController AdditionalDc
        {
            DomainName                    = $DomainName
            Credential                    = $DomainAdminDN
            SafemodeAdministratorPassword = $DomainAdminSafe
            DependsOn                     = "[WaitForADDomain]DscForestWait"
        }

        WaitForADDomain DscForestWait2
        {
            DomainName           = $DomainName
            Credential           = $DomainAdminDN
            WaitTimeout          = 900
            RestartCount         = 2
            WaitForValidCredentials = $True
            DependsOn = "[ADDomainController]AdditionalDc"
        }     
    }
}

The operating system the target node is running

Azure VM
OsName : Microsoft Windows Server 2019 Datacenter
OsOperatingSystemSKU : DatacenterServerEdition
OsArchitecture : 64-bit
WindowsVersion : 1809
WindowsBuildLabEx : 17763.1.amd64fre.rs5_release.180914-1434
OsLanguage : en-US
OsMuiLanguages : {en-US}

Version and build of PowerShell the target node is running

PSVersion 5.1.17763.2268
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17763.2268
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

Version of the DSC module that was used

6.0.1

The text was updated successfully, but these errors were encountered:

johlju · 2022-03-10T17:14:16Z

Hmm. WaitForADDomain finds the domain, probably on the primary controller, then the script continue with the ADDomainController which seems to fail on the row:

ActiveDirectoryDsc/source/DSCResources/MSFT_ADDomainController/MSFT_ADDomainController.psm1

Line 62 in f8bf122

$domain = Get-ADDomain -Identity $DomainName -Credential $Credential

Following the verbose messages the function Test-TargetResource calls Get-TargetResource and then throws on the above command.

For some reason it cannot find the domain. Looking at WaitForADDomain it does not use Get-ADDomain, it uses the local function Find-DomainController that do not use Get-ADDomain.

ActiveDirectoryDsc/source/Modules/ActiveDirectoryDsc.Common/ActiveDirectoryDsc.Common.psm1

Line 1906 in f8bf122

function Find-DomainController

So might it be that either we replace the Get-ADDomain with Find-DomainController, or we can remove Get-ADDomain entirely... The point with Get-ADDomain is to make sure the domain is available, at least one domain controller is up and answering in the domain. Will Find-DomainController work better here since it works for WaitForADDomain?

jquinn99002 · 2022-03-25T11:36:17Z

@johlju Do we know when this might be looked into and a fix applied?

johlju · 2022-03-26T16:31:15Z

When someone in the community picks this up and propose a change that works.

Maybe you can test the suggestion I made above, in you local copy of the module? If someone can confirm what change is needed then it is easier for someone in the community to make the change.

jkattmann · 2022-03-28T17:26:59Z

Just ran into this myself ... here is a fix that seems to work for me, I simply adopted the existing retry logic from ADDomain Get-TargetResource used when calling Get-ADDomain.

jkattmann@97c7021

I can open a PR if makes sense?

johlju · 2022-03-28T17:44:54Z

@jkattmann it makes sense, but could we move it to a helper function in ActiveDirectoryDsc.Common? There are unit tests that need to be moved/modified as well. Gladly see a PR for this.

jquinn99002 · 2022-04-02T13:18:52Z

@jkattmann is this something you could do? This is all a bit beyond me. And I don't think I can use your fork of the branch because I'm importing the nodule into an Azure Automation account.

jkattmann · 2022-05-10T01:42:03Z

@johlju I opened a PR for this with your suggestions to move to a helper function in ActiveDirectoryDsc.Common and updated the unit tests that need to be moved/modified, please have a look.

johlju · 2022-05-10T06:35:44Z

For sure I will look at it, thank you. I probably won't have time until this weekend, but it is at the top of the todo list. 🙂

johlju added bug The issue is a bug. help wanted The issue is up for grabs for anyone in the community. needs investigation The issue needs to be investigated by the maintainers or/and the community. labels Mar 10, 2022

jkattmann mentioned this issue May 5, 2022

Fix ad domain controller #686

Merged

9 tasks

johlju added in progress The issue is being actively worked on by someone. and removed help wanted The issue is up for grabs for anyone in the community. needs investigation The issue needs to be investigated by the maintainers or/and the community. labels May 10, 2022

johlju closed this as completed in #686 May 17, 2022

johlju removed the in progress The issue is being actively worked on by someone. label May 17, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ADDomainController: MSFT_ADDomainController failed to execute Test-TargetResource functionality with error message: System.Exception: Current node could not find the domain #673

ADDomainController: MSFT_ADDomainController failed to execute Test-TargetResource functionality with error message: System.Exception: Current node could not find the domain #673

jquinn99002 commented Mar 10, 2022

johlju commented Mar 10, 2022

jquinn99002 commented Mar 25, 2022

johlju commented Mar 26, 2022

jkattmann commented Mar 28, 2022

johlju commented Mar 28, 2022

jquinn99002 commented Apr 2, 2022

jkattmann commented May 10, 2022

johlju commented May 10, 2022

ADDomainController: MSFT_ADDomainController failed to execute Test-TargetResource functionality with error message: System.Exception: Current node could not find the domain #673

ADDomainController: MSFT_ADDomainController failed to execute Test-TargetResource functionality with error message: System.Exception: Current node could not find the domain #673

Comments

jquinn99002 commented Mar 10, 2022

Details of the scenario you tried and the problem that is occurring

Verbose logs showing the problem

Suggested solution to the issue

The DSC configuration that is used to reproduce the issue (as detailed as possible)

The operating system the target node is running

Version and build of PowerShell the target node is running

Version of the DSC module that was used

johlju commented Mar 10, 2022

jquinn99002 commented Mar 25, 2022

johlju commented Mar 26, 2022

jkattmann commented Mar 28, 2022

johlju commented Mar 28, 2022

jquinn99002 commented Apr 2, 2022

jkattmann commented May 10, 2022

johlju commented May 10, 2022