SqlSetup: Add documentation around how to use built-in account

[johlju]

Details of the scenario you tried and the problem that is occurring

To use built-in accounts a password must be provided in the credential properties, e.g. SQLSvcAccount. That password can be any string as the password is ignored by the resource when it sees a built-in account, e.g. 'NT AUTHORITY\NetworkService'.

Verbose logs showing the problem

n/a

Suggested solution to the issue

Add information around this into the documentation of the SqlSetup resource.

The DSC configuration that is used to reproduce the issue (as detailed as possible)

n/a

SQL Server edition and version the target node is running

Any

SQL Server PowerShell modules present on the target node

Any

The operating system the target node is running

Any

Version and build of PowerShell the target node is running

Any

Version of the DSC module that was used ('dev' if using current dev branch)

Dev

[kungfoome]

This would be useful for group service account as well. But this also begs the question, is there any reason we can't just pass it a string as well?

[johlju]

It can’t be a string because if the account used actually have a password, for example a domain account, then the password should be encrypted, that’s why it needs to be a PSCredential object.

[kungfoome]

@johlju I get that. Not suggesting to get rid of that, but I was thinking more along the lines of using CredentialAttribute, but I'm not sure it makes it any less complicated thinking about it. I'll have to do a few tests of mine own to see

[cnilak]

Is there an example to use gMsa?

[johlju]

@cnilak I don't think so. If you do install using gMSA please sen in an example. It would be much appreciated.

[rdeheld]

I would also like a solution for this, Isnt this possible by just passing the credential it as a string?

[kungfoome]

@rdeheld @cnilak I'll try to post example later. Hopefully I can't remember. But it's really just creating a credential, but make sure you add '$' at the end and the password can be anything

[WobblyDave]

You still have to pass a password - even if it is a fake one. I am using the SqlServiceAccount DSC resource & after many hours of head scratching I found a post where gMSA credential is passed with the dollar sign and a fake password.

Generate a fake password string to prevent NULL password errors during execution

        $password = ('temppassword' | ConvertTo-SecureString -AsPlainText -Force)

         # Create PSCredential objects for use in SQLServiceAccount resource
         $gmsaSqlServiceCred = new-object -typename System.Management.Automation.PSCredential -argumentlist $SqlSvcAccount,$password

I then passed the PSCredential object into the resource.

SqlServiceAccount SetSQLServiceAccountgMSA{

             ServerName           = $Node.ServerName
             InstanceName         = $Node.InstanceName
             ServiceType          = 'DatabaseEngine'
             ServiceAccount       = $gmsaSqlServiceCred
             RestartService       = $true
             PsDscRunAsCredential = $SQLInstallCredential
         }

you cannot just pass the object as a string because it errors out & you cannot create a PSCredential without a password. All a bit counter intuitive.

http://ryannielsen.org/2020/06/desired-state-configuration-sql-always-on-deployment/

Please note that I have already include the domain in the service account string & just appended a dollar sign to it.