Can't run New-GPPGroupMember with variables in group name without creating exception
Closed this issue · 5 comments
OK, here goes
I'm trying to automate the steps in the following guides for managing a number of local groups via Group Policy Preferences:
- https://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/
- https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/using-group-policy-preferences-to-manage-the-local-administrator/ba-p/259223
However New-GPPGroupMember currently throws an exception if the group name passed can't be translated at runtime and the guide involves creating group names which include a preference process variable (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789194(v=ws.11)#preference-process-variables)
PS C:\Windows\system32> New-GPPGroupMember -N "%DomainName%\%ComputerName Administrators" -Action ADD
Exception calling "Translate" with "1" argument(s): "Some or all identity references could not be translated."
At C:\Program Files\WindowsPowerShell\Modules\PSGPPreferences\0.2.0\Groups\New-GPPGroupMember.ps1:14 char:9
+ $SID = ([System.Security.Principal.NTAccount]::new($Name)).Tr ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : IdentityNotMappedException
name action sid
---- ------ ---
%DomainName%\%ComputerName Administrators ADD
Please could this exception be caught with a try / catch loop? I have tried using -ErrorAction SilentlyContinue but the exception is still thrown 'behind the scenes' and since I am trying to do this with PowerShell DSC and it doesn't like exceptions at all.
Ah, so that exception appears when there is no security identity with that name in the current domain. Of course when using variables here, there most likely won't be an account with such a name.
I will add code to process this situation - the name will be saved, but the SID property will remain unpopulated.
@Borgquite Please check the dev branch
Thanks - seems to be suppressing the error. May need to wait for the new version to be deployed before I can fully test in DSC (can't really deploy dev modules to a production server)
Managed to get a test environment where I could update the module, works w/ DSC :)
Fixed in e5bc74e