Error connecting to JEA endpoint

[matbe]

When trying to connect to the JEA-endpoint I get the following error:

`New-PSSession : One or more errors occurred processing the module 'LATER' specified in the
InitialSessionState object used to create this runspace. See the ErrorRecords property for a
complete list of errors. The first error was: Could not import C:\Program
Files\WindowsPowerShell\Modules\dbatools\1.0.43\bin\smo\Microsoft.SqlServer.BatchParser.dll :
Exception calling "LoadFrom" with "1" argument(s): "Could not load file or assembly
'Microsoft.SqlServer.BatchParser.dll' or one of its dependencies. The specified module could not
be found."
At C:\Program
Files\WindowsPowerShell\Modules\dbatools\1.0.43\internal\scripts\libraryimport.ps1:123 char:17

•             [Reflection.Assembly]::LoadFrom($assemblyPath)
  

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], MethodInvocationException
  • FullyQualifiedErrorId : FileNotFoundException

At line:2 char:16

• ... $Session = New-PSSession -ComputerName $LATERServer -ConfigurationNa ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-
    PSSession], RemoteException
  • FullyQualifiedErrorId : PSSessionOpenFailed`

Could you please provide a little more info on how to set up the endpoint and if there are any prereqs on the server or client side?
The Endpoint is not on the SQL server in my case if that is related?
Does the service account need more permissions than "user" on the endpoint server?

[PhilipHaglund]

@matbe, on the JEA endpoint is the PowerShell module dbatools and AdmPwd.PS installed?

[matbe]

@PhilipHaglund yes. The server with the endpoint is also the LAPS server.
dbatools was installed with "install-module".

I tried adding "dbatools" as a required module in the "New-PSSessionConfigurationFile" but then I got another error instead.

[PhilipHaglund]

Try to restart the WinRM service on the JEA endpoint. If that doesn't work, try to re-register the JEA endpoint.

What is the output from:

Get-PSSessionConfiguration -Name LATER | Select-Object -Property *

[matbe]

Not sure how to re-register (unless you mean "Unregister .... -Force" and then running the scripts again, if so I have already tried).
Have already tried restarting both WinRM and computer. Same error.

Output you requested:
ExecutionPolicy : RemoteSigned TranscriptDirectory : C:\PSTranscripts\ ModulesToImport : LATER GUID : 1432a225-1873-4f1e-bd58-54ceee658469 Author : Omnicit AB SessionType : Default RoleDefinitions : {CORP\res-sys-later requester} SchemaVersion : 2.0.0.0 LanguageMode : NoLanguage RunAsPassword : System.Security.SecureString ResourceUri : http://schemas.microsoft.com/powershell/LATER Capability : {Shell} PSVersion : 5.1 AutoRestart : false ExactMatch : False RunAsVirtualAccount : false SDKVersion : 2 Uri : http://schemas.microsoft.com/powershell/LATER MaxConcurrentCommandsPerShell : 2147483647 IdleTimeoutms : 7200000 ParentResourceUri : http://schemas.microsoft.com/powershell/LATER RunAsUser : CORP\svc-admpwd OutputBufferingMode : Block Architecture : 64 UseSharedProcess : false MaxProcessesPerShell : 2147483647 Filename : %windir%\system32\pwrshplugin.dll MaxShellsPerUser : 2147483647 ConfigFilePath : C:\Windows\System32\WindowsPowerShell\v1.0\SessionConfig\LATER_1432a225-1873-4f1e-bd5 8-54ceee658469.pssc MaxShells : 2147483647 SupportsOptions : true lang : en-US MaxIdleTimeoutms : 2147483647 xmlns : http://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration Enabled : True SecurityDescriptorSddl : O:NSG:BAD:P(A;;GA;;;S-1-5-21-3712103235-4237124459-3398765260-1603)S:P(AU;FA;GA;;;WD) (AU;SA;GXGW;;;WD) Name : LATER ProcessIdleTimeoutSec : 0 MaxConcurrentUsers : 2147483647 MaxMemoryPerShellMB : 2147483647 RunAsVirtualAccountGroups : XmlRenderingType : text Permission : CORP\res-sys-later requester AccessAllowed

[matbe]

If I changed
RequiredModules = @('AdmPwd.PS', 'dbatools')
to
RequiredModules = @('AdmPwd.PS')

in the LATER.psd1 file then I can create a connection to the JEA endpoint. So seems to be related to the dbatools module in some way?

[matbe]

@PhilipHaglund which version of dbatools do you use? Might be worth a shot trying the same version you have working.

[PhilipHaglund]

Running version 1.0.29 of dbatools. Installed the LATER module on another JEA-endpoint (machine) and I receive the same problem as you. Both with 1.0.29 and the latest version 1.0.43 of dbatools.
Perhaps there is something when running SQL or SSMS on the same node that runs LATER.

Looks like there is a bug: dataplat/dbatools#5989

[matbe]

Ok thanks. I rewrote the script using ado.net to make the sql calls so there is no dependecy to dbatools until the bug is corrected.
Now it works to the point where it is supposed to add the 'NT AUTHORITY\INTERACTIVE' to the admingroup but it doesn't work.

Adding a -NoExit to the Start-process shows that it succesfully creates a session as "client\administrator" but it is not elevated (UAC issue) so the Add-GroupMember fails:
Add-LocalGroupMember : Access denied.

And trying the following code in the "start-process" session gives a "FALSE":
([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

[PhilipHaglund]

Does any of the following GPO settings differ from the default?
https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings#user-account-control-run-all-administrators-in-admin-approval-mode

[matbe]

Only policy i have applied to the client is the LAPS-Gpo beside that everything is pretty much out of the box. Confirmed with secpol that the default settings are applied.

[PhilipHaglund]

If you logon locally with the local admin account and the LAPS password and start powershell normally, is it elevated?

[matbe]

If I logon as admin its not elevated, i need to use "run as administrator" and accept the UAC prompt (Yes/No).

[PhilipHaglund]

Aah, just remembered that I had to configure this for it to work out of the box:

This is the full configuration I have on the client side:

[matbe]

Ok I think I have solved it so UAC still can be turned on but it requires the add-member function to be in a separate script. Is there any specific reason why that part of the command is in an "encoded command"? In my solution the code can not be encoded.

I also submitted a pull request to remove the dependency to "dbatools".