DFSNamespaceRoot: Access to a CIM resource was not available to the client.
Closed this issue · 5 comments
Details of the scenario you tried and the problem that is occurring
I am attempting to run this using Ansible and have come to a deadstop on attempting to run the following configuration:
- name: DFSNamespaceRoot
win_dsc:
resource_name: DFSNamespaceRoot
Path: '\\[domain]\Web-Certificates-test'
TargetPath: '\\{{ ansible_hostname }}\DFS'
Ensure: Present
Type: DomainV2
tags: test
I receive a log which I have pasted below - I have replicated the problem using a configuration file which I have also added into this issue. Also I have had a look at a few tickets and have seen FQDN being mentioned and this does not seem to eliminate the problem. If you could give me some pointers as to where I am going wrong here I would very much appreciate it.
Background note: webtestduo is staged first as it has the GUI installed in intend to deploy these as headless Windows Core Installs of which webtestuno is.
Thanks in advance,
Jason
Verbose logs showing the problem
fatal: [webtestduo]: FAILED! => {
"changed": false,
"invocation": {
"module_args": {
"DependsOn": null,
"Description": null,
"EnableAccessBasedEnumeration": null,
"EnableInsiteReferrals": null,
"EnableRootScalability": null,
"EnableSiteCosting": null,
"EnableTargetFailback": null,
"Ensure": "Present",
"Path": "\\\\[domain]\\Web-Certificates-test",
"PsDscRunAsCredential_password": null,
"PsDscRunAsCredential_username": null,
"ReferralPriorityClass": null,
"ReferralPriorityRank": null,
"TargetPath": "\\\\webtestduo.[domain]\\DFS'",
"TimeToLiveSec": null,
"Type": "DomainV2",
"module_version": "latest",
"resource_name": "DFSNamespaceRoot"
}
},
"module_version": "4.4.0.0",
"msg": "Failed to invoke DSC Set method: PowerShell DSC resource MSFT_DFSNamespaceRoot failed to execute Set-TargetResource functionality with error message: The running command stopped because the preference variable \"ErrorActionPreference\" or common parameter is set to Stop: Access to a CIM resource was not available to the client. ",
"reboot_required": false,
"verbose_set": [
"Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = ResourceSet,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'.",
"An LCM method call arrived from computer webtestDUO with user sid S-1-5-21-117609710-436374069-1060284298-73812.",
"[WEBTESTDUO]: LCM: [ Start Set ] [[DFSNamespaceRoot]DirectResourceAccess]",
"[WEBTESTDUO]: [[DFSNamespaceRoot]DirectResourceAccess] Set-TargetResource: Setting DomainV2 DFS Namespace Root \"\\\\[domain]\\Web-Certificates-test\" on target \"\\\\webtestduo.[domain]\\DFS'\".",
"[WEBTESTDUO]: [[DFSNamespaceRoot]DirectResourceAccess] Performing operation \"Create DFS Namespace\" on Target \"\\\\[domain]\\Web-Certificates-test\"",
"[WEBTESTDUO]: LCM: [ End Set ] [[DFSNamespaceRoot]DirectResourceAccess] in 0.2960 seconds.",
"Operation 'Invoke CimMethod' complete.",
"Time taken for configuration job to complete is 0.43 seconds"
],
"verbose_test": [
"Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = ResourceTest,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'.",
"An LCM method call arrived from computer webtestDUO with user sid S-1-5-21-117609710-436374069-1060284298-73812.",
"[WEBTESTDUO]: LCM: [ Start Test ] [[DFSNamespaceRoot]DirectResourceAccess]",
"[WEBTESTDUO]: [[DFSNamespaceRoot]DirectResourceAccess] Test-TargetResource: Testing DomainV2 DFS Namespace Root \"\\\\[domain]\\Web-Certificates-test\" on target \"\\\\webtestduo.[domain]\\DFS'\".",
"[WEBTESTDUO]: [[DFSNamespaceRoot]DirectResourceAccess] Test-TargetResource: DomainV2 DFS Namespace Root \"\\\\[domain]\\Web-Certificates-test\" does not exist but should. Change required.",
"[WEBTESTDUO]: LCM: [ End Test ] [[DFSNamespaceRoot]DirectResourceAccess] False in 0.5320 seconds.",
"[WEBTESTDUO]: LCM: [ End Set ] in 0.5790 seconds.",
"Operation 'Invoke CimMethod' complete.",
"Time taken for configuration job to complete is 0.668 seconds"
]
}
Suggested solution to the issue
At this point I have no idea...
The DSC configuration that is used to reproduce the issue (as detailed as possible)
I am using ansible and this is how it looks inside the playbook:
- name: DFSNamespaceRoot
win_dsc:
resource_name: DFSNamespaceRoot
Path: '\\[domain]\Web-Certificates-test'
TargetPath: '\\{{ ansible_hostname }}\DFS'
Ensure: Present
Type: DomainV2
tags: test
I have reproduced the problem using this config in powershell:
configuration SampleDFS
{
Import-DscResource -ModuleName 'DFSDsc'
Node "webtestduo"
{
# Configure the namespace
DFSNamespaceRoot webtestduo
{
Path = '\\[domain]\Web-Certificates-test'
TargetPath = '\\webtestduo\DFS'
Ensure = 'Present'
Type = 'DomainV2'
Description = 'webtestduoTest'
} # End of DFSNamespaceRoot Resource
DFSNamespaceRoot webtestuno
{
Path = '\\[domain]\Web-Certificates-test'
TargetPath = '\\webtestuno\DFS'
Ensure = 'Present'
Type = 'DomainV2'
Description = 'webtestunoTest'
} # End of DFSNamespaceRoot Resource
}
}
The operating system the target node is running
OsName : Microsoft Windows Server 2022 Standard Evaluation
OsOperatingSystemSKU : 79
OsArchitecture : 64-bit
WindowsVersion : 2009
WindowsBuildLabEx : 20348.1.amd64fre.fe_release.210507-1500
OsLanguage : en-US
OsMuiLanguages : {en-US}
Version and build of PowerShell the target node is running
Name Value
---- -----
PSVersion 5.1.20348.1
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.20348.1
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
Version of the DSC module that was used ('dev' if using current dev branch)
Mentioned in Verbose log as being module version 4.4.0.0
Hi @jw-price1985 - have you tried using the FQDN for all of the [domain] and [hostname] entries? DFS tends to have issues when mixing and matching domain names with FQDN etc, and so using FQDN and fully qualified hostnames for everything is recommended.
I have attempted with shortened names and FQDN, either gives me the same issue.
Hey @jw-price1985, I've also been busy with Ansible and creating a DFSNamespaceRoot. I've managed to make it work by adding:
PsDscRunAsCredential_username: '{{ ansible_user }}'
PsDscRunAsCredential_password: '{{ ansible_password }}'
@jw-price1985 @Jasperswaagman Had the same issue here - you apparently must run the DFSNamespaceRoot resource as an account with Domain Admin credentials using PsDscRunAsCredential - see the documentation for examples.
Closing his per previous comment. If there is still an issue please reopen.