几个月来，我一直可靠地使用ARM模板来创建主域控制器和备份域控制器(基于快速入门模板中的"active-directory-new-domain-ha-2-dc"(。周五，它停止工作，没有进行任何修改。
问题出在主 DC 上。xADDomain DSC 资源触发重新启动，如第一个 DSC 日志的以下摘录所示：
VERBOSE: [2020-05-22 15:22:17Z] [VERBOSE] [tipaADPDC]: LCM: [ End Resource
] [[xADDomain]FirstDS]
VERBOSE: [2020-05-22 15:22:17Z] [VERBOSE] [tipaADPDC]:
[] A reboot is required to progress further. Please reboot the system.
Configuration will not be continued after the reboot. To continue
configuration, use Start-DscConfiguration -UseExisting after reboot.
VERBOSE: [2020-05-22 15:22:17Z] [WARNING] [tipaADPDC]:
[] A reboot is required to progress further. Please reboot the system.
Configuration will not be continued after the reboot. To continue
configuration, use Start-DscConfiguration -UseExisting after reboot.
重新启动后，在第二个 DSC 日志中可以看到以下安全错误：
VERBOSE: [2020-05-22 15:23:28Z] Will continue the existing configuration.
Executing Start-DscConfiguration with -UseExisting option ...
VERBOSE: [2020-05-22 15:23:28Z] Settings handler status to 'transitioning'
(C:PackagesPluginsMicrosoft.Powershell.DSC2.80.0.0Status .status)
VERBOSE: [2020-05-22 15:23:29Z] [VERBOSE] Perform operation 'Invoke CimMethod'
with following parameters, ''methodName' = ApplyConfiguration,'className' =
MSFT_DSCLocalConfigurationManager,'namespaceName' =
root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: [2020-05-22 15:23:29Z] [ERROR] WinRM cannot process the request. The
following error with errorcode 0x80090350 occurred while using Negotiate
authentication: An unknown security error occurred.
由于没有对 ARM 模板或 DSC 资源进行任何更改，因此我认为这是由于部署选择了最新版本的内容。
我尝试过的事情：
- 使用 DSC 2.76 而不是 2.80
- 使用 WMF 5.0 而不是 5.1
- 使用Windows Server 2019-Datacenter而不是2016(似乎 自 20190603 年以来，2016 年的图像没有更新。
我还研究了防止 DSC 在重新启动后重新启动(没有更多资源要处理(。但是，我认为由于第一个DSC日志中的以下条目，这些设置已经进行了：
VERBOSE: [2020-05-22 15:18:42Z] WMF 5 or newer, Injecting RebootNodeIfNeeded =
False and ActionAfterReboot = "StopConfiguration"
VERBOSE: [2020-05-22 15:18:47Z] Get-DscLocalConfigurationManager:
ActionAfterReboot : StopConfiguration
RebootNodeIfNeeded : False
我被困住了。有人有什么想法吗？ 谢谢。
最近遇到了类似的问题。稍微不同的是，我使用的是ActiveDirectoryDsc，而不是xADDomain。当我将操作系统升级到Windows Server 2019-Datacenter时，错误消失了。
潜在的根本原因可能是 2016 年至 2019 年之间的 Powershell 版本。这是我的日志。
- 视窗服务器 2016
VERBOSE: [2020-06-01 03:47:34Z] Settings handler status to 'transitioning'
(C:PackagesPluginsMicrosoft.Powershell.DSC2.80.0.0Status .status)
VERBOSE: [2020-06-01 03:47:34Z] Retrieving system information ...
VERBOSE: [2020-06-01 03:47:40Z] OS Version : 10.0
VERBOSE: [2020-06-01 03:47:40Z] Server OS : True
VERBOSE: [2020-06-01 03:47:40Z] 64-bit OS : True
VERBOSE: [2020-06-01 03:47:40Z] PS Version : 5.1.14393.3471
VERBOSE: [2020-06-01 03:47:40Z] Validating user provided settings for the DSC
Extension Handler ...
重新启动后
VERBOSE: [2020-06-01 03:53:05Z] Settings handler status to 'transitioning'
(C:PackagesPluginsMicrosoft.Powershell.DSC2.80.0.0Status .status)
VERBOSE: [2020-06-01 03:53:05Z] Will continue the existing configuration.
Executing Start-DscConfiguration with -UseExisting option ...
VERBOSE: [2020-06-01 03:53:05Z] Settings handler status to 'transitioning'
(C:PackagesPluginsMicrosoft.Powershell.DSC2.80.0.0Status .status)
VERBOSE: [2020-06-01 03:53:07Z] [VERBOSE] Perform operation 'Invoke CimMethod'
with following parameters, ''methodName' = ApplyConfiguration,'className' =
MSFT_DSCLocalConfigurationManager,'namespaceName' =
root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: [2020-06-01 03:53:07Z] [ERROR] WinRM cannot process the request. The
following error with errorcode 0x80090350 occurred while using Negotiate
authentication: An unknown security error occurred.
Possible causes are:
-The user name or password specified are invalid.
-Kerberos is used when no authentication method and no user name are
specified.
-Kerberos accepts domain user names, but not local user names.
-The Service Principal Name (SPN) for the remote computer name and port does
not exist.
-The client and remote computers are in different domains and there is no
trust between the two domains.
After checking for the above issues, try the following:
-Check the Event Viewer for events related to authentication.
-Change the authentication method; add the destination computer to the WinRM
TrustedHosts configuration setting or use HTTPS transport.
Note that computers in the TrustedHosts list might not be authenticated.
-For more information about WinRM configuration, run the following command:
winrm help config.
VERBOSE: [2020-06-01 03:53:07Z] [VERBOSE] Operation 'Invoke CimMethod'
complete.
VERBOSE: [2020-06-01 03:53:07Z] [VERBOSE] Time taken for configuration job to
complete is 0.039 seconds
- Windows Server 2019
VERBOSE: [2020-06-01 08:33:17Z] Settings handler status to 'transitioning'
(C:PackagesPluginsMicrosoft.Powershell.DSC2.80.0.0Status .status)
VERBOSE: [2020-06-01 08:33:18Z] Retrieving system information ...
VERBOSE: [2020-06-01 08:33:22Z] OS Version : 10.0
VERBOSE: [2020-06-01 08:33:22Z] Server OS : True
VERBOSE: [2020-06-01 08:33:22Z] 64-bit OS : True
VERBOSE: [2020-06-01 08:33:22Z] PS Version : 5.1.17763.1007
VERBOSE: [2020-06-01 08:33:22Z] Validating user provided settings for the DSC Extension Handler ...
重新启动后
VERBOSE: [2020-06-01 08:38:49Z] Settings handler status to 'transitioning'
(C:PackagesPluginsMicrosoft.Powershell.DSC2.80.0.0Status .status)
VERBOSE: [2020-06-01 08:38:49Z] Will continue the existing configuration. Executing Start-DscConfiguration with
-UseExisting option ...
VERBOSE: [2020-06-01 08:38:50Z] Settings handler status to 'transitioning'
(C:PackagesPluginsMicrosoft.Powershell.DSC2.80.0.0Status .status)
VERBOSE: [2020-06-01 08:38:51Z] [VERBOSE] Perform operation 'Invoke CimMethod' with following parameters, ''methodName'
= ApplyConfiguration,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' =
root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: [2020-06-01 08:38:51Z] [VERBOSE] An LCM method call arrived from computer adPDC with user sid S-1-5-18.
我们遇到了同样的问题。我们意识到这个问题只发生在某些特定类型的 VM 上，win_2016Datacenter。
- 虚拟机类型"Standard_F4s_v2"重现此问题
- 但其他 VM 不会发生这种情况，例如"Standard_DS2_v2"
我不确定您使用的是哪种类型的 VM，作为解决方法，您可以尝试使用不同的 VM 类型。
这里描述了同样的问题： DSC 配置"AD"已完成，但出现错误。以下是前几个：WinRM 无法处理请求
对我来说，解决方案是在创建虚拟机之后但在运行PowerShellDSC之前运行以下CMDlet：
Set-ItemProperty -Path "HKLM:SYSTEMCurrentControlSetServicesWindowsAzureGuestAgent" -Name DependOnService -Type MultiString -Value DNS
我将以下内容添加到我的 Bicep 文件中：
resource setScript 'Microsoft.Compute/virtualMachines/runCommands@2021-07-01' = {
name: 'RunCommand'
location: location
parent: vm
properties: {
asyncExecution: false
source: {
script: 'Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WindowsAzureGuestAgent" -Name DependOnService -Type MultiString -Value DNS'
}
timeoutInSeconds: 30
}
}
父资源是"Microsoft.计算/virtualMachines@2021-03-01"资源。有一个后续的PowerShellDSC VM扩展资源依赖于此"runCommand"资源。因此，将创建 VM，运行 Set-ItemProperty 命令，然后运行 PowerShell DSC 配置。然后，AD 域创建工作正常。
CMDlet 将 Windows Azure Guest Agent 服务设置为在启动之前等待 DNS 服务器服务。据推测，如果没有此设置，Windows Azure Guest Agent 服务将在 DNS 和名称解析失败之前启动，这搞砸了 WinRM。不一致的服务启动顺序也可能解释不同 VM 大小的不同体验。