activedirectorydsc
Version information
This version is compatible with:
- Puppet Enterprise 2023.2.x, 2023.1.x, 2023.0.x, 2021.7.x, 2021.6.x, 2021.5.x, 2021.4.x, 2021.3.x, 2021.2.x, 2021.1.x, 2021.0.x, 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x
- Puppet >= 6.0.0 < 8.0.0
Start using this module
Add this module to your Puppetfile:
mod 'dsc-activedirectorydsc', '4.0.0-0-1'
Learn more about managing modules with a PuppetfileDocumentation
Table of Contents
Description
This is an auto-generated module, using the Puppet DSC Builder to vendor and expose the PowerShell module's DSC resources as Puppet resources. The functionality of this module comes entirely from the vendored PowerShell resources, which are pinned at v4.0.0.0. The PowerShell module describes itself like this:
_The ActiveDirectoryDsc module contains DSC resources for deployment and configuration of Active Directory.
These DSC resources allow you to configure new domains, child domains, and high availability domain controllers, establish cross-domain trusts and manage users, groups and OUs._
For information on troubleshooting to determine whether any encountered problems are with the Puppet wrapper or the DSC resource, see the troubleshooting section below.
Requirements
This module, like all auto-generated Puppetized DSC modules, relies on two important technologies in the Puppet stack: the Puppet Resource API and the puppetlabs/pwshlib Puppet module.
The Resource API provides a simplified option for writing types and providers and is responsible for how this module is structured. The Resource API ships inside of Puppet starting with version 6. While it is technically possible to add the Resource API functionality to Puppet 5.5.x, the DSC functionality has not been tested in this setup. For more information on the Resource API, review the documentation.
The module also depends on the pwshlib module. This Puppet module includes two important things: the ruby-pwsh library for running PowerShell code from ruby and the base provider for DSC resources, which this module leverages.
All of the actual work being done to call the DSC resources vendored with this module is in this file from the pwshlib module. This is important for troubleshooting and bug reporting, but doesn't impact your use of the module except that the end result will be that nothing works, as the dependency is not installed alongside this module!
Usage
You can specify any of the DSC resources from this module like a normal Puppet resource in your manifests. The examples below use DSC resources from from the PowerShellGet repository, regardless of what module you're looking at here; the syntax, not the specifics, is what's important.
For reference documentation about the DSC resources exposed in this module, see the Reference Forge tab, or the REFERENCE.md file.
# Include a meaningful title for your resource declaration
dsc_psrepository { 'Add team module repo':
dsc_name => 'foo',
dsc_ensure => present,
# This location is nonsense, can be any valid folder on your
# machine or in a share, any location the SourceLocation param
# for the DSC resource will accept.
dsc_sourcelocation => 'C:\Program Files',
# You must always pass an enum fully lower-cased;
# Puppet is case sensitive even when PowerShell isn't
dsc_installationpolicy => untrusted,
}
dsc_psrepository { 'Trust public gallery':
dsc_name => 'PSGallery',
dsc_ensure => present,
dsc_installationpolicy => trusted,
}
dsc_psmodule { 'Make Ruby manageable via uru':
dsc_name => 'RubyInstaller',
dsc_ensure => present,
}
For more information about using a built module, check out our narrative documentation.
Properties
Note that the only properties specified in a resource declaration which are passed to Invoke-Dsc are all prepended with dsc.
If a property does _not start with dsc_ it is used to control how Puppet interacts with DSC/other Puppet resources - for example,
specifying a unique name for the resource for Puppet to distinguish between declarations or Puppet metaparameters (notifies,
before, etc).
Troubleshooting
In general, there are three broad categories of problems:
- Problems with the way the underlying DSC resource works.
- Problems with the type definition, where you can't specify a valid set of properties for the DSC resource
- Problems with calling the underlying DSC resource - the parameters aren't being passed correctly or the resource can't be found
Unfortunately, problems with the way the underlying DSC resource works are something we can't help directly with. You'll need to file an issue with the upstream maintainers for the PowerShell module.
Problems with the type definition are when a value that should be valid according to the DSC resource's documentation and code is not accepted by the Puppet wrapper. If and when you run across one of these, please file an issue with the Puppet DSC Builder; this is where the conversion happens and once we know of a problem we can fix it and regenerate the Puppet modules. To help us identify the issue, please specify the DSC module, version, resource, property and values that are giving you issues. Once a fix is available we will regenerate and release updated versions of this Puppet wrapper.
Problems with calling the underlying DSC resource become apparent by comparing <value passed in in puppet>
with <value received by DSC>
.
In this case, please file an issue with the puppetlabs/pwshlib module, which is where the DSC base provider actually lives.
We'll investigate and prioritize a fix and update the puppetlabs/pwshlib module.
Updating to the pwshlib version with the fix will immediately take advantage of the improved functionality without waiting for this module to be reconverted and published.
For specific information on troubleshooting a generated module, check the troubleshooting guide for the puppet.dsc module.
Known Limitations
Currently, because of the way Puppet caches files on agents, use of the legacy puppetlabs-dsc
module is not compatible with this or any auto-generated DSC module.
Inclusion of both will lead to pluginsync conflicts.
Reference
Table of Contents
Resource types
dsc_adcomputer
: The DSC ADComputer resource type. Automatically generated from version 4.0.0.0dsc_addomain
: The DSC ADDomain resource type. Automatically generated from version 4.0.0.0dsc_addomaincontroller
: The DSC ADDomainController resource type. Automatically generated from version 4.0.0.0dsc_addomaindefaultpasswordpolicy
: The DSC ADDomainDefaultPasswordPolicy resource type. Automatically generated from version 4.0.0.0dsc_addomaintrust
: The DSC ADDomainTrust resource type. Automatically generated from version 4.0.0.0dsc_adforestproperties
: The DSC ADForestProperties resource type. Automatically generated from version 4.0.0.0dsc_adgroup
: The DSC ADGroup resource type. Automatically generated from version 4.0.0.0dsc_adkdskey
: The DSC ADKDSKey resource type. Automatically generated from version 4.0.0.0dsc_admanagedserviceaccount
: The DSC ADManagedServiceAccount resource type. Automatically generated from version 4.0.0.0dsc_adobjectenabledstate
: The DSC ADObjectEnabledState resource type. Automatically generated from version 4.0.0.0dsc_adobjectpermissionentry
: The DSC ADObjectPermissionEntry resource type. Automatically generated from version 4.0.0.0dsc_adoptionalfeature
: The DSC ADOptionalFeature resource type. Automatically generated from version 4.0.0.0dsc_adorganizationalunit
: The DSC ADOrganizationalUnit resource type. Automatically generated from version 4.0.0.0dsc_adreplicationsite
: The DSC ADReplicationSite resource type. Automatically generated from version 4.0.0.0dsc_adreplicationsitelink
: The DSC ADReplicationSiteLink resource type. Automatically generated from version 4.0.0.0dsc_adreplicationsubnet
: The DSC ADReplicationSubnet resource type. Automatically generated from version 4.0.0.0dsc_adserviceprincipalname
: The DSC ADServicePrincipalName resource type. Automatically generated from version 4.0.0.0dsc_aduser
: The DSC ADUser resource type. Automatically generated from version 4.0.0.0dsc_waitforaddomain
: The DSC WaitForADDomain resource type. Automatically generated from version 4.0.0.0
Resource types
dsc_adcomputer
The DSC ADComputer resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adcomputer
type.
dsc_description
Data type: Optional[String]
Specifies a description of the computer account.
dsc_displayname
Data type: Optional[String]
Specifies the display name of the computer account.
dsc_distinguishedname
Data type: Optional[String]
Returns the X.500 path of the computer object.
dsc_dnshostname
Data type: Optional[String]
Specifies the fully qualified domain name (FQDN) of the computer account.
dsc_domaincontroller
Data type: Optional[String]
Specifies the Active Directory Domain Services instance to connect to perform the task.
dsc_enabled
Data type: Optional[Boolean]
Returns $true if the computer object is enabled, otherwise it returns $false.
dsc_enabledoncreation
Data type: Optional[Boolean]
Specifies if the computer account is created enabled or disabled. By default the Enabled property of the computer account will be set to the default value of the cmdlet New-ADComputer. This property is ignored if the parameter RequestFile is specified in the same configuration. This parameter does not enforce the property Enabled. To enforce the property Enabled see the resource ADObjectEnabledState.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies whether the computer account is present or absent. Default value is 'Present'.
dsc_location
Data type: Optional[String]
Specifies the location of the computer, such as an office number.
dsc_manager
Data type: Optional[String]
Specifies the user or group Distinguished Name that manages the computer account. Valid values are the user's or group's DistinguishedName, ObjectGUID, SID or SamAccountName.
dsc_path
Data type: Optional[String]
Specifies the X.500 path of the Organizational Unit (OU) or container where the computer is located.
dsc_requestfile
Data type: Optional[String]
Specifies the full path to the Offline Domain Join Request file to create.
dsc_restorefromrecyclebin
Data type: Optional[Boolean]
Try to restore the computer account from the recycle bin before creating a new one.
dsc_samaccountname
Data type: Optional[String]
Returns the security identifier of the computer object.
dsc_serviceprincipalnames
Data type: Optional[Array[String]]
Specifies the service principal names for the computer account.
dsc_sid
Data type: Optional[String]
Returns the security identifier of the computer object.
dsc_userprincipalname
Data type: Optional[String]
Specifies the User Principal Name (UPN) assigned to the computer account.
Parameters
The following parameters are available in the dsc_adcomputer
type.
dsc_computername
namevar
Data type: String
Specifies the name of the Active Directory computer account to manage. You can identify a computer by its distinguished name, GUID, security identifier (SID) or Security Accounts Manager (SAM) account name.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Specifies the user account credentials to use to perform the task.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_addomain
The DSC ADDomain resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_addomain
type.
dsc_databasepath
Data type: Optional[String]
Path to a directory that contains the domain database.
dsc_domainmode
Data type: Optional[Enum['Win2008', 'Win2008R2', 'Win2012', 'Win2012R2', 'WinThreshold']]
The Domain Functional Level for the entire domain.
dsc_domainnetbiosname
Data type: Optional[String]
NetBIOS name for the new domain.
dsc_forestmode
Data type: Optional[Enum['Win2008', 'Win2008R2', 'Win2012', 'Win2012R2', 'WinThreshold']]
The Forest Functional Level for the entire forest.
dsc_logpath
Data type: Optional[String]
Path to a directory for the log file that will be written.
dsc_parentdomainname
Data type: Optional[String]
Fully qualified domain name (FQDN) of the parent domain.
dsc_sysvolpath
Data type: Optional[String]
Path to a directory where the Sysvol file will be written.
Parameters
The following parameters are available in the dsc_addomain
type.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Specifies the user name and password that corresponds to the account used to install the domain controller.
dsc_dnsdelegationcredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Credential used for creating DNS delegation.
dsc_domainname
namevar
Data type: String
The fully qualified domain name (FQDN) of the new domain.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
dsc_safemodeadministratorpassword
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Password for the administrator account when the computer is started in Safe Mode.
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_addomaincontroller
The DSC ADDomainController resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_addomaincontroller
type.
dsc_allowpasswordreplicationaccountname
Data type: Optional[Array[String]]
Specifies an array of names of user accounts, group accounts, and computer accounts whose passwords can be replicated to this Read-Only Domain Controller (RODC).
dsc_databasepath
Data type: Optional[String]
The path where the database will be stored.
dsc_denypasswordreplicationaccountname
Data type: Optional[Array[String]]
Specifies the names of user accounts, group accounts, and computer accounts whose passwords are not to be replicated to this Read-Only Domain Controller (RODC).
dsc_ensure
Data type: Optional[String]
Returns the state of the Domain Controller.
dsc_flexiblesinglemasteroperationrole
Data type: Optional[Array[Enum['DomainNamingMaster', 'SchemaMaster', 'InfrastructureMaster', 'PDCEmulator', 'RIDMaster']]]
Specifies one or more Flexible Single Master Operation (FSMO) roles to move to this domain controller. The current owner must be online and responding for the move to be allowed.
dsc_installationmediapath
Data type: Optional[String]
The path of the media you want to use install the Domain Controller.
dsc_isglobalcatalog
Data type: Optional[Boolean]
Specifies if the domain controller will be a Global Catalog (GC).
dsc_logpath
Data type: Optional[String]
The path where the logs will be stored.
dsc_readonlyreplica
Data type: Optional[Boolean]
Indicates that the cmdlet installs the domain controller as an Read-Only Domain Controller (RODC) for an existing domain.
dsc_sitename
Data type: Optional[String]
The name of the site this Domain Controller will be added to.
dsc_sysvolpath
Data type: Optional[String]
The path where the Sysvol will be stored.
Parameters
The following parameters are available in the dsc_addomaincontroller
type.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
The credentials (as a 'PSCredential' object) of a user that has Domain Administrator rights to add the Domain Controller to the domain.
dsc_domainname
namevar
Data type: String
The fully qualified domain name (FQDN) of the domain the Domain Controller will be joining.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
dsc_safemodeadministratorpassword
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
The 'PSCredential' object containing the password to use for Directory Services Restore Mode (DSRM).
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_addomaindefaultpasswordpolicy
The DSC ADDomainDefaultPasswordPolicy resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_addomaindefaultpasswordpolicy
type.
dsc_complexityenabled
Data type: Optional[Boolean]
Whether password complexity is enabled for the default password policy.
dsc_domaincontroller
Data type: Optional[String]
Active Directory domain controller to enact the change upon.
dsc_lockoutduration
Data type: Optional[Integer[0, 4294967295]]
Length of time that an account is locked after the number of failed login attempts (minutes).
dsc_lockoutobservationwindow
Data type: Optional[Integer[0, 4294967295]]
Maximum time between two unsuccessful login attempts before the counter is reset to 0 (minutes).
dsc_lockoutthreshold
Data type: Optional[Integer[0, 4294967295]]
Number of unsuccessful login attempts that are permitted before an account is locked out.
dsc_maxpasswordage
Data type: Optional[Integer[0, 4294967295]]
Maximum length of time that you can have the same password (minutes).
dsc_minpasswordage
Data type: Optional[Integer[0, 4294967295]]
Minimum length of time that you can have the same password (minutes).
dsc_minpasswordlength
Data type: Optional[Integer[0, 4294967295]]
Minimum number of characters that a password must contain.
dsc_passwordhistorycount
Data type: Optional[Integer[0, 4294967295]]
Number of previous passwords to remember.
dsc_reversibleencryptionenabled
Data type: Optional[Boolean]
Whether the directory must store passwords using reversible encryption.
Parameters
The following parameters are available in the dsc_addomaindefaultpasswordpolicy
type.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Credentials used to access the domain.
dsc_domainname
namevar
Data type: String
Name of the domain to which the password policy will be applied.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_addomaintrust
The DSC ADDomainTrust resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_addomaintrust
type.
dsc_allowtrustrecreation
Data type: Optional[Boolean]
Specifies if the is allowed to be recreated if required. Default value is $false.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies whether the computer account is present or absent. Default value is 'Present'.
dsc_trustdirection
Data type: Enum['Bidirectional', 'Inbound', 'Outbound']
Specifies the direction of the trust.
dsc_trusttype
Data type: Enum['External', 'Forest']
Specifies the type of trust. The value 'External' means the context Domain, while the value 'Forest' means the context 'Forest'.
Parameters
The following parameters are available in the dsc_addomaintrust
type.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
dsc_sourcedomainname
namevar
Data type: String
Specifies the name of the Active Directory domain that is requesting the trust.
dsc_targetcredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Specifies the credentials to authenticate to the target domain.
dsc_targetdomainname
namevar
Data type: String
Specifies the name of the Active Directory domain that is being trusted.
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adforestproperties
The DSC ADForestProperties resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adforestproperties
type.
dsc_serviceprincipalnamesuffix
Data type: Optional[Array[String]]
Specifies the Service Principal Name (SPN) Suffix(es) to be explicitly defined in the forest and replace existing Service Principal Names. Cannot be used with ServicePrincipalNameSuffixToAdd or ServicePrincipalNameSuffixToRemove.
dsc_serviceprincipalnamesuffixtoadd
Data type: Optional[Array[String]]
Specifies the Service Principal Name (SPN) Suffix(es) to be added to the forest. Cannot be used with ServicePrincipalNameSuffix.
dsc_serviceprincipalnamesuffixtoremove
Data type: Optional[Array[String]]
Specifies the Service Principal Name (SPN) Suffix(es) to be removed from the forest. Cannot be used with ServicePrincipalNameSuffix.
dsc_userprincipalnamesuffix
Data type: Optional[Array[String]]
Specifies the User Principal Name (UPN) Suffix(es) to be explicitly defined in the forest and replace existing User Principal Names. Cannot be used with UserPrincipalNameSuffixToAdd or UserPrincipalNameSuffixToRemove.
dsc_userprincipalnamesuffixtoadd
Data type: Optional[Array[String]]
Specifies the User Principal Name (UPN) Suffix(es) to be added to the forest. Cannot be used with UserPrincipalNameSuffix.
dsc_userprincipalnamesuffixtoremove
Data type: Optional[Array[String]]
Specifies the User Principal Name (UPN) Suffix(es) to be removed from the forest. Cannot be used with UserPrincipalNameSuffix.
Parameters
The following parameters are available in the dsc_adforestproperties
type.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Specifies the user account credentials to use to perform this task.
dsc_forestname
namevar
Data type: String
Specifies the target Active Directory forest for the change.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adgroup
The DSC ADGroup resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adgroup
type.
dsc_category
Data type: Optional[Enum['Security', 'Distribution']]
Active Directory group category. Default value is 'Security'.
dsc_description
Data type: Optional[String]
Description of the Active Directory group.
dsc_displayname
Data type: Optional[String]
Display name of the Active Directory group.
dsc_domaincontroller
Data type: Optional[String]
Active Directory domain controller to enact the change upon.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies if this Active Directory group should be present or absent. Default value is 'Present'.
dsc_groupscope
Data type: Optional[Enum['DomainLocal', 'Global', 'Universal']]
Active Directory group scope. Default value is 'Global'.
dsc_managedby
Data type: Optional[String]
Active Directory managed by attribute specified as a DistinguishedName.
dsc_members
Data type: Optional[Array[String]]
Active Directory group membership should match membership exactly.
dsc_membershipattribute
Data type: Optional[Enum['SamAccountName', 'DistinguishedName', 'ObjectGUID', 'SID']]
Active Directory attribute used to perform membership operations. Default value is 'SamAccountName'.
dsc_memberstoexclude
Data type: Optional[Array[String]]
Active Directory group should NOT include these members.
dsc_memberstoinclude
Data type: Optional[Array[String]]
Active Directory group should include these members.
dsc_notes
Data type: Optional[String]
Active Directory group notes field.
dsc_path
Data type: Optional[String]
Location of the group within Active Directory expressed as a Distinguished Name.
dsc_restorefromrecyclebin
Data type: Optional[Boolean]
Try to restore the group from the recycle bin before creating a new one.
Parameters
The following parameters are available in the dsc_adgroup
type.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Credentials used to enact the change upon.
dsc_groupname
namevar
Data type: String
Name of the Active Directory group.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adkdskey
The DSC ADKDSKey resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adkdskey
type.
dsc_allowunsafeeffectivetime
Data type: Optional[Boolean]
This option will allow you to create a KDS root key if EffectiveTime is set in the past. This may cause issues if you are creating a Group Managed Service Account right after you create the KDS Root Key. In order to get around this, you must create the KDS Root Key using a date in the past. This should be used at your own risk and should only be used in lab environments.
dsc_creationtime
Data type: Optional[Timestamp]
Returns the Creation date and time of the KDS root key for informational purposes.
dsc_distinguishedname
Data type: Optional[String]
Returns the Distinguished Name (DN) of the KDS root key. The KDS Root Key is stored in 'CN=Master Root Keys,CN=Group Key Distribution Service,CN=Services,CN=Configuration' at the Forest level. This is also why replication needs 10 hours to occur before using the KDS Root Key as a safety measure.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies if this KDS Root Key should be present or absent. Default value is 'Present'.
dsc_forceremove
Data type: Optional[Boolean]
This option will allow you to remove a KDS root key if there is only one key left. It should not break your Group Managed Service Accounts (gMSA), but if the gMSA password expires and it needs to request a new password, it will not be able to generate a new password until a new KDS Root Key is installed and ready for use. Because of this, the last KDS Root Key will not be removed unless this option is specified.
dsc_keyid
Data type: Optional[String]
Returns the KeyID of the KDS root key. This is the Common Name (CN) within Active Directory and is required to build the Distinguished Name.
Parameters
The following parameters are available in the dsc_adkdskey
type.
dsc_effectivetime
namevar
Data type: String
Specifies the Effective time when a KDS root key can be used. There is a 10 hour minimum from creation date to allow active directory to properly replicate across all domain controllers. For this reason, the date must be set in the future for creation. While this parameter accepts a string, it will be converted into a DateTime object. This will also try to take into account cultural settings. Example: '05/01/1999 13:00 using default or 'en-US' culture would be May 1st, but using 'de-DE' culture would be 5th of January. The culture is automatically pulled from the operating system and this can be checked using 'Get-Culture'.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_admanagedserviceaccount
The DSC ADManagedServiceAccount resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_admanagedserviceaccount
type.
dsc_accounttype
Data type: Optional[Enum['Group', 'Single']]
The type of managed service account. Single will create a Single Managed Service Account (sMSA) and Group will create a Group Managed Service Account (gMSA). If not specified, this value defaults to Single.
dsc_accounttypeforce
Data type: Optional[Boolean]
Specifies whether or not to remove the service account and recreate it when going from Single Managed Service Account to Group Managed Service Account and vice-versa. If not specified, this value defaults to $false.
dsc_description
Data type: Optional[String]
Specifies a description of the object (ldapDisplayName 'description').
dsc_displayname
Data type: Optional[String]
Specifies the display name of the object (ldapDisplayName 'displayName').
dsc_distinguishedname
Data type: Optional[String]
Returns the Distinguished Name of the Service Account.
dsc_domaincontroller
Data type: Optional[String]
Specifies the Active Directory Domain Controller instance to use to perform the task. This is only required if not executing the task on a domain controller.
dsc_enabled
Data type: Optional[Boolean]
Returns whether the user account is enabled or disabled.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies whether the user account is created or deleted. If not specified, this value defaults to Present.
dsc_members
Data type: Optional[Array[String]]
Specifies the members of the object (ldapDisplayName 'PrincipalsAllowedToRetrieveManagedPassword'). Only used when 'Group' is selected for 'AccountType'.
dsc_membershipattribute
Data type: Optional[Enum['SamAccountName', 'DistinguishedName', 'ObjectGUID', 'SID']]
Active Directory attribute used to perform membership operations for Group Managed Service Accounts (gMSA). If not specified, this value defaults to SamAccountName. Only used when 'Group' is selected for 'AccountType'. Default value is 'SamAccountName'.
dsc_path
Data type: Optional[String]
Specifies the X.500 path of the Organizational Unit (OU) or container where the new object is created. Specified as a Distinguished Name (DN).
Parameters
The following parameters are available in the dsc_admanagedserviceaccount
type.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Specifies the user account credentials to use to perform this task. This is only required if not executing the task on a domain controller or using the parameter DomainController.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
dsc_serviceaccountname
namevar
Data type: String
Specifies the Security Account Manager (SAM) account name of the managed service account (ldapDisplayName 'sAMAccountName'). To be compatible with older operating systems, create a SAM account name that is 20 characters or less. Once created, the user's SamAccountName and CN cannot be changed.
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adobjectenabledstate
The DSC ADObjectEnabledState resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adobjectenabledstate
type.
dsc_domaincontroller
Data type: Optional[String]
Specifies the Active Directory Domain Services instance to connect to perform the task.
dsc_enabled
Data type: Boolean
Specifies the value of the Enabled property.
Parameters
The following parameters are available in the dsc_adobjectenabledstate
type.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Specifies the user account credentials to use to perform the task.
dsc_identity
namevar
Data type: String
Specifies the identity of an object that has the object class specified in the parameter ObjectClass. When ObjectClass is set to 'Computer' then this property can be set to either distinguished name, GUID (objectGUID), security identifier (objectSid), or security Accounts Manager account name (sAMAccountName).
dsc_objectclass
namevar
Data type: Enum['Computer']
Specifies the object class.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adobjectpermissionentry
The DSC ADObjectPermissionEntry resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adobjectpermissionentry
type.
dsc_activedirectoryrights
Data type: Optional[Array[Enum['AccessSystemSecurity', 'CreateChild', 'Delete', 'DeleteChild', 'DeleteTree', 'ExtendedRight', 'GenericAll', 'GenericExecute', 'GenericRead', 'GenericWrite', 'ListChildren', 'ListObject', 'ReadControl', 'ReadProperty', 'Self', 'Synchronize', 'WriteDacl', 'WriteOwner', 'WriteProperty']]]
A combination of one or more of the ActiveDirectoryRights enumeration values that specifies the rights of the access rule. Default value is 'GenericAll'.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Indicates if the access will be added (Present) or will be removed (Absent). Default value is 'Present'.
Parameters
The following parameters are available in the dsc_adobjectpermissionentry
type.
dsc_accesscontroltype
namevar
Data type: Enum['Allow', 'Deny']
Indicates whether to Allow or Deny access to the target object.
dsc_activedirectorysecurityinheritance
namevar
Data type: Enum['All', 'Children', 'Descendents', 'None', 'SelfAndChildren']
One of the 'ActiveDirectorySecurityInheritance' enumeration values that specifies the inheritance type of the access rule.
dsc_identityreference
namevar
Data type: String
Indicates the identity of the principal for the ACE. Use the notation DOMAIN\SamAccountName for the identity.
dsc_inheritedobjecttype
namevar
Data type: String
The schema GUID of the child object type that can inherit this access rule. If the permission entry shouldn't be restricted to a specific inherited object type, use the zero guid (00000000-0000-0000-0000-000000000000).
dsc_objecttype
namevar
Data type: String
The schema GUID of the object to which the access rule applies. If the permission entry shouldn't be restricted to a specific object type, use the zero guid (00000000-0000-0000-0000-000000000000).
dsc_path
namevar
Data type: String
Active Directory path of the target object to add or remove the permission entry, specified as a Distinguished Name.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adoptionalfeature
The DSC ADOptionalFeature resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adoptionalfeature
type.
dsc_enabled
Data type: Optional[Boolean]
Shows the current state of the feature i.e. enabled or not
Parameters
The following parameters are available in the dsc_adoptionalfeature
type.
dsc_enterpriseadministratorcredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Specifies the user account credentials to use to perform this task.
dsc_featurename
namevar
Data type: String
Specifies the feature to be activated
dsc_forestfqdn
namevar
Data type: String
Specifies the target Active Directory forest for the change.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adorganizationalunit
The DSC ADOrganizationalUnit resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adorganizationalunit
type.
dsc_description
Data type: Optional[String]
The description of the Organization Unit (OU). Default value is empty ('') description.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies whether the Organization Unit (OU) is present or absent. Default value is 'Present'.
dsc_protectedfromaccidentaldeletion
Data type: Optional[Boolean]
Specifies if the Organization Unit (OU) container should be protected from deletion. Default value is $true.
dsc_restorefromrecyclebin
Data type: Optional[Boolean]
Try to restore the Organization Unit (OU) from the recycle bin before creating a new one.
Parameters
The following parameters are available in the dsc_adorganizationalunit
type.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
The credential to be used to perform the operation on Active Directory.
dsc_name
namevar
Data type: String
The name of Organization Unit (OU).
dsc_path
namevar
Data type: String
Specifies the X.500 path of the Organization Unit (OU) or container where the new object is created.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adreplicationsite
The DSC ADReplicationSite resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adreplicationsite
type.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies if the Active Directory replication site should be present or absent. Default value is 'Present'.
dsc_renamedefaultfirstsitename
Data type: Optional[Boolean]
Specifies if the Default-First-Site-Name should be renamed if it exists. Default value is $false.
Parameters
The following parameters are available in the dsc_adreplicationsite
type.
dsc_name
namevar
Data type: String
Specifies the name of the Active Directory replication site.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adreplicationsitelink
The DSC ADReplicationSiteLink resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adreplicationsitelink
type.
dsc_cost
Data type: Optional[Integer[-2147483648, 2147483647]]
Specifies the cost to be placed on the site link.
dsc_description
Data type: Optional[String]
This parameter sets the value of the Description property for the object.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies if the site link should be present or absent. Default value is 'Present'.
dsc_replicationfrequencyinminutes
Data type: Optional[Integer[-2147483648, 2147483647]]
Species the frequency (in minutes) for which replication will occur where this site link is in use between sites.
dsc_sitesexcluded
Data type: Optional[Array[String]]
Specifies the list of sites to exclude from the site link.
dsc_sitesincluded
Data type: Optional[Array[String]]
Specifies the list of sites included in the site link.
Parameters
The following parameters are available in the dsc_adreplicationsitelink
type.
dsc_name
namevar
Data type: String
Specifies the name of the site link.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adreplicationsubnet
The DSC ADReplicationSubnet resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adreplicationsubnet
type.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies if the Active Directory replication subnet should be present or absent. Default value is 'Present'.
dsc_location
Data type: Optional[String]
The location for the Active Directory replication site. Default value is empty ('') location.
dsc_site
Data type: String
The name of the assigned Active Directory replication site, e.g. Default-First-Site-Name.
Parameters
The following parameters are available in the dsc_adreplicationsubnet
type.
dsc_name
namevar
Data type: String
The name of the Active Directory replication subnet, e.g. 10.0.0.0/24.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_adserviceprincipalname
The DSC ADServicePrincipalName resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_adserviceprincipalname
type.
dsc_account
Data type: Optional[String]
The user or computer account to add or remove the SPN, e.b. User1 or LON-DC1$. Default value is ''. If Ensure is set to Present, a value must be specified.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies if the service principal name should be added or remove. Default value is 'Present'.
Parameters
The following parameters are available in the dsc_adserviceprincipalname
type.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
dsc_serviceprincipalname
namevar
Data type: String
The full SPN to add or remove, e.g. HOST/LON-DC1.
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_aduser
The DSC ADUser resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_aduser
type.
dsc_accountnotdelegated
Data type: Optional[Boolean]
Indicates whether the security context of the user is delegated to a service. When this parameter is set to true, the security context of the account is not delegated to a service even when the service account is set as trusted for Kerberos delegation. This parameter sets the AccountNotDelegated property for an Active Directory account. This parameter also sets the ADS_UF_NOT_DELEGATED flag of the Active Directory User Account Control (UAC) attribute.
dsc_allowreversiblepasswordencryption
Data type: Optional[Boolean]
Indicates whether reversible password encryption is allowed for the account. This parameter sets the AllowReversiblePasswordEncryption property of the account. This parameter also sets the ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED flag of the Active Directory User Account Control (UAC) attribute.
dsc_cannotchangepassword
Data type: Optional[Boolean]
Specifies whether the account password can be changed.
dsc_changepasswordatlogon
Data type: Optional[Boolean]
Specifies whether the account password must be changed during the next logon attempt. This will only be enabled when the user is initially created. This parameter cannot be set to $true if the parameter PasswordNeverExpires is also set to $true.
dsc_city
Data type: Optional[String]
Specifies the user's town or city (ldapDisplayName 'l').
dsc_commonname
Data type: Optional[String]
Specifies the common name assigned to the user account (ldapDisplayName 'cn'). If not specified the default value will be the same value provided in parameter UserName.
dsc_company
Data type: Optional[String]
Specifies the user's company (ldapDisplayName 'company').
dsc_compoundidentitysupported
Data type: Optional[Boolean]
Specifies whether an account supports Kerberos service tickets which includes the authorization data for the user's device. This value sets the compound identity supported flag of the Active Directory msDS-SupportedEncryptionTypes attribute.
dsc_country
Data type: Optional[String]
Specifies the country or region code for the user's language of choice (ldapDisplayName 'c').
dsc_department
Data type: Optional[String]
Specifies the user's department (ldapDisplayName 'department').
dsc_description
Data type: Optional[String]
Specifies a description of the object (ldapDisplayName 'description').
dsc_displayname
Data type: Optional[String]
Specifies the display name of the object (ldapDisplayName 'displayName').
dsc_distinguishedname
Data type: Optional[String]
Returns the X.500 path of the object.
dsc_division
Data type: Optional[String]
Specifies the user's division (ldapDisplayName 'division').
dsc_domaincontroller
Data type: Optional[String]
Specifies the Active Directory Domain Services instance to use to perform the task.
dsc_emailaddress
Data type: Optional[String]
Specifies the user's e-mail address (ldapDisplayName 'mail').
dsc_employeeid
Data type: Optional[String]
Specifies the user's employee ID (ldapDisplayName 'employeeID').
dsc_employeenumber
Data type: Optional[String]
Specifies the user's employee number (ldapDisplayName 'employeeNumber').
dsc_enabled
Data type: Optional[Boolean]
Specifies if the account is enabled. Default value is $true.
dsc_ensure
Data type: Optional[Enum['Present', 'Absent']]
Specifies whether the user account should be present or absent. Default value is 'Present'.
dsc_fax
Data type: Optional[String]
Specifies the user's fax phone number (ldapDisplayName 'facsimileTelephoneNumber').
dsc_givenname
Data type: Optional[String]
Specifies the user's given name (ldapDisplayName 'givenName').
dsc_homedirectory
Data type: Optional[String]
Specifies a user's home directory path (ldapDisplayName 'homeDirectory').
dsc_homedrive
Data type: Optional[String]
Specifies a drive that is associated with the UNC path defined by the HomeDirectory property (ldapDisplayName 'homeDrive').
dsc_homepage
Data type: Optional[String]
Specifies the URL of the home page of the object (ldapDisplayName 'wWWHomePage').
dsc_homephone
Data type: Optional[String]
Specifies the user's home telephone number (ldapDisplayName 'homePhone').
dsc_initials
Data type: Optional[String]
Specifies the initials that represent part of a user's name (ldapDisplayName 'initials').
dsc_ipphone
Data type: Optional[String]
Specifies the user's IP telephony phone number (ldapDisplayName 'ipPhone').
dsc_jobtitle
Data type: Optional[String]
Specifies the user's title (ldapDisplayName 'title').
dsc_logonscript
Data type: Optional[String]
Specifies a path to the user's log on script (ldapDisplayName 'scriptPath').
dsc_logonworkstations
Data type: Optional[String]
Specifies the computers that the user can access. To specify more than one computer, create a single comma-separated list. You can identify a computer by using the Security Account Manager (SAM) account name (sAMAccountName) or the DNS host name of the computer. The SAM account name is the same as the NetBIOS name of the computer. The LDAP display name (ldapDisplayName) for this property is userWorkStations.
dsc_manager
Data type: Optional[String]
Specifies the user's manager specified as a Distinguished Name (ldapDisplayName 'manager').
dsc_mobilephone
Data type: Optional[String]
Specifies the user's mobile phone number (ldapDisplayName 'mobile').
dsc_notes
Data type: Optional[String]
Specifies the notes attached to the user's accoutn (ldapDisplayName 'info').
dsc_office
Data type: Optional[String]
Specifies the location of the user's office or place of business (ldapDisplayName 'physicalDeliveryOfficeName').
dsc_officephone
Data type: Optional[String]
Specifies the user's office telephone number (ldapDisplayName 'telephoneNumber').
dsc_organization
Data type: Optional[String]
Specifies the user's organization. This parameter sets the Organization property of a user object. The LDAP display name (ldapDisplayName) of this property is 'o'.
dsc_othername
Data type: Optional[String]
Specifies a name in addition to a user's given name and surname, such as the user's middle name. This parameter sets the OtherName property of a user object. The LDAP display name (ldapDisplayName) of this property is 'middleName'.
dsc_pager
Data type: Optional[String]
Specifies the user's pager number (ldapDisplayName 'pager').
dsc_passwordauthentication
Data type: Optional[Enum['Default', 'Negotiate']]
Specifies the authentication context type used when testing passwords. Default value is 'Default'.
dsc_passwordneverexpires
Data type: Optional[Boolean]
Specifies whether the password of an account can expire.
dsc_passwordneverresets
Data type: Optional[Boolean]
Specifies whether existing user's password should be reset. Default value is $false.
dsc_passwordnotrequired
Data type: Optional[Boolean]
Specifies whether the account requires a password. A password is not required for a new account. This parameter sets the PasswordNotRequired property of an account object.
dsc_path
Data type: Optional[String]
Specifies the X.500 path of the Organizational Unit (OU) or container where the new object is created.
dsc_pobox
Data type: Optional[String]
Specifies the user's post office box number (ldapDisplayName 'postOfficeBox').
dsc_postalcode
Data type: Optional[String]
Specifies the user's postal code or zip code (ldapDisplayName 'postalCode').
dsc_profilepath
Data type: Optional[String]
Specifies a path to the user's profile (ldapDisplayName 'profilePath').
dsc_proxyaddresses
Data type: Optional[Array[String]]
Specifies the proxy addresses for the user account.
dsc_restorefromrecyclebin
Data type: Optional[Boolean]
Try to restore the user object from the recycle bin before creating a new one.
dsc_serviceprincipalnames
Data type: Optional[Array[String]]
Specifies the service principal names for the user account.
dsc_smartcardlogonrequired
Data type: Optional[Boolean]
Specifies whether a smart card is required to logon. This parameter sets the SmartCardLoginRequired property for a user object. This parameter also sets the ADS_UF_SMARTCARD_REQUIRED flag of the Active Directory User Account Control attribute.
dsc_state
Data type: Optional[String]
Specifies the user's or Organizational Unit's state or province (ldapDisplayName 'st').
dsc_streetaddress
Data type: Optional[String]
Specifies the user's street address (ldapDisplayName 'streetAddress').
dsc_surname
Data type: Optional[String]
Specifies the user's last name or surname (ldapDisplayName 'sn').
dsc_thumbnailphoto
Data type: Optional[String]
Specifies the thumbnail photo to be used for the user object. Can be set either to a path pointing to a .jpg-file, or to a Base64-encoded jpeg image. If set to an empty string ('') the current thumbnail photo will be removed. The property ThumbnailPhoto will always return the image as a Base64-encoded string even if the configuration specified a file path.
dsc_thumbnailphotohash
Data type: Optional[String]
Return the MD5 hash of the current thumbnail photo, or $null if no thumbnail photo exist.
dsc_trustedfordelegation
Data type: Optional[Boolean]
Specifies whether an account is trusted for Kerberos delegation. Default value is $false.
dsc_userprincipalname
Data type: Optional[String]
Specifies the User Principal Name (UPN) assigned to the user account (ldapDisplayName 'userPrincipalName').
Parameters
The following parameters are available in the dsc_aduser
type.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Specifies the user account credentials to use to perform this task.
dsc_domainname
namevar
Data type: String
Name of the domain where the user account is located (only used if password is managed).
dsc_password
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Specifies a new password value for the account.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
dsc_username
namevar
Data type: String
Specifies the Security Account Manager (SAM) account name of the user (ldapDisplayName 'sAMAccountName').
name
namevar
Data type: String
Description of the purpose for this resource declaration.
dsc_waitforaddomain
The DSC WaitForADDomain resource type. Automatically generated from version 4.0.0.0
Properties
The following properties are available in the dsc_waitforaddomain
type.
dsc_isavailable
Data type: Optional[Boolean]
Returns a value indicating if a domain controller was found.
dsc_restartcount
Data type: Optional[Integer[0, 4294967295]]
Specifies the number of times the node will be reboot in an effort to connect to the domain.
dsc_sitename
Data type: Optional[String]
Specifies the site in the domain where to look for a domain controller.
dsc_waittimeout
Data type: Optional[Integer[0, 18446744073709551615]]
Specifies the timeout in seconds that the resource will wait for the domain to be accessible. Default value is 300 seconds.
Parameters
The following parameters are available in the dsc_waitforaddomain
type.
dsc_credential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
Specifies the credentials that are used when accessing the domain, unless the built-in PsDscRunAsCredential is used.
dsc_domainname
namevar
Data type: String
Specifies the fully qualified domain name to wait for.
dsc_psdscrunascredential
Data type: Optional[Struct[{ user => String[1], password => Sensitive[String[1]] }]]
name
namevar
Data type: String
Description of the purpose for this resource declaration.
Change log for ActiveDirectoryDsc
Unreleased
4.0.0.0
- Changes to ActiveDirectoryDsc
- BREAKING CHANGE: ADRecycleBin is replaced by the new resource ADOptionalFeature (issue #162).
- New resource ADOptionalFeature (issue #162).
- BREAKING CHANGE: Renamed the xActiveDirectory to ActiveDirectoryDsc and removed the 'x' from all resource names (issue #312).
- The helper function
Find-DomainController
is exported in the module manifest. When runningImport-Module -Name ActiveDirectoryDsc
the module will also import the nested module ActiveDirectoryDsc.Common. It is exported so that the resource WaitForADDomain can reuse code when running a background job to search for a domain controller. - Module manifest has been updated to optimize module auto-discovery according to the article PowerShell module authoring considerations (issue #463).
- Added a Requirements section to every DSC resource README with the bullet point stating "Target machine must be running Windows Server 2008 R2 or later" (issue #399).
- Added 'about_\<DSCResource>.help.txt' file to all resources (issue #404).
- Fixed an issue that the helper function
Add-ADCommonGroupMember
was not outputting the correct group name in a verbose message and in an error message. - Style guideline cleanup.
- Cleaned up some minor style violations in the code.
- All localized strings in the resources now has a string ID suffix (issue #419).
- All schema properties description now ends with full stop (.) (issue #420).
- Updated all types in the resources schema to use PascalCase.
- Updated all resource read-only parameters to start the description with 'Returns...' so it is more clear that the property cannot be assigned a value.
- The default value on resource parameters are now reflected in the parameter descriptions in the schema.mof (so that Wiki will be updated) (issue #426).
- Removed unnecessary Script Analyzer rule overrides from tests.
- Added new helper functions in xActiveDirectory.Common.
- New-CimCredentialInstance
- Add-TypeAssembly
- New-ADDirectoryContext
- Changes to ActiveDirectoryDsc.Common:
- Removed unused parameter
ModuleName
fromAssert-MemberParameters
function. - Removed unused parameter
ModuleName
fromConvertTo-DeploymentForestMode
function. - Removed unused parameter
ModuleName
fromConvertTo-DeploymentDomainMode
function. - Added function help (issue #321).
- Removed the helper function
ThrowInvalidOperationError
andThrowInvalidArgumentError
in favor of the new helper functions for localization (issue #316, issue #317). - Removed the alias
DomainAdministratorCredential
from the parameterCredential
in the functionRestore-ADCommonObject
- Removed the alias
DomainAdministratorCredential
from the parameterCredential
in the functionGet-ADCommonParameters
- Added function
Find-DomainController
. - Added function
Get-CurrentUser
(moved from the resource ADKDSKey). - Refactor
Remove-DuplicateMembers
and added more unit tests (issue #443). - Minor cleanup in
Test-Members
because of the improvedRemove-DuplicateMembers
. - Minor cleanup in
Assert-MemberParameters
because of the improvedRemove-DuplicateMembers
.
- Removed unused parameter
- Updated all the examples files to be prefixed with the resource name so they are more easily discovered in PowerShell Gallery and Azure Automation (issue #416).
- Fix examples that had duplicate guid that would have prevented them to be published.
- Integration tests are now correctly evaluates the value from
Test-DscConfiguration
(issue #434). - Update all tests to use
| Should -BeTrue
and| Should -BeFalse'
.
- Changes to ADManagedServiceAccount
- Added a requirement to README stating "Group Managed Service Accounts need at least one Windows Server 2012 Domain Controller" (issue #399).
- Using
$PSBoundParameters.Remove()
returns a[System.Boolean]
to indicate of the removal was done or not. That returned value has been suppressed (issue #466).
- Changes to ADComputer
- BREAKING CHANGE: The previously made obsolete parameter
Enabled
has been removed and is now a read-only property. See resource documentation how to enforce theEnabled
property. - BREAKING CHANGE: Renamed the parameter
DomainAdministratorCredential
toCredential
to better indicate that it is possible to impersonate any credential with enough permission to perform the task (issue #269). - Fixed the GUID in Example 3-AddComputerAccountSpecificPath_Config (issue #410).
- Add example showing how to create cluster computer account (issue #401).
- BREAKING CHANGE: The previously made obsolete parameter
- Changes to ADOrganizationalUnit
- Catch exception when the path property specifies a non-existing path (issue #408).
- The unit tests are using the stub classes so the tests can be run locally.
- Added comment-based help (issue #339).
- Changes to ADUser
- BREAKING CHANGE: Renamed the parameter
DomainAdministratorCredential
toCredential
to better indicate that it is possible to impersonate any credential with enough permission to perform the task (issue #269). - Fixes exception when creating a user with an empty string property (issue #407).
- Fixes exception when updating
CommonName
andPath
concurrently (issue #402). - Fixes ChangePasswordAtLogon Property to be only set to
true
at User Creation (issue #414). - Added comment-based help (issue #340).
- Now it correctly tests passwords when parameter DomainName is set to distinguished name and parameter Credential is used (issue #451).
- Added integration tests (issue #359).
- Update the logic for setting the default value for the parameter
CommonName
. This is due to an how LCM handles parameters when a default value is derived from another parameter (issue #427). - Now uses the helper function
Add-TypeAssembly
which have some benefit instead of directly usingAdd-Type
, like verbose logging (issue #431). - Add new property
ThumbnailPhoto
and read-only propertyThumbnailPhotoHash
(issue #44).
- BREAKING CHANGE: Renamed the parameter
- Changes to ADDomain
- BREAKING CHANGE: Renamed the parameter
DomainAdministratorCredential
toCredential
to better indicate that it is possible to impersonate any credential with enough permission to perform the task (issue #269). - BREAKING CHANGE: A new parameter
AllowTrustRecreation
has been added that when set allows a trust to be recreated in scenarios where that is required. This way the user have to opt-in to such destructive action since since it can result in service interruption (issue #421). - Updated tests and replaced
Write-Error
withthrow
(issue #332). - Added comment-based help (issue #335).
- Using
$PSBoundParameters.Remove()
returns a[System.Boolean]
to indicate of the removal was done or not. That returned value has been suppressed (issue #466).
- BREAKING CHANGE: Renamed the parameter
- Changes to ADServicePrincipalName
- Minor change to the unit tests that did not correct assert the localized string when an account is not found.
- Changes to ADDomainTrust
- BREAKING CHANGE: Renamed the parameter
TargetDomainAdministratorCredential
toTargetCredential
to better indicate that it is possible to impersonate any credential with enough permission to perform the task (issue #269). - Refactored the resource to enable unit tests, and at the same time changed it to use the same code pattern as the resource xADObjectEnabledState.
- Added unit tests (issue #324).
- Added comment-based help (issue #337).
- Added integration tests (issue #348).
- BREAKING CHANGE: Renamed the parameter
- Changes to WaitForADDomain
- BREAKING CHANGE: Refactored the resource to handle timeout better and more correctly wait for a specific amount of time, and at the same time make the resource more intuitive to use. This change has replaced parameters in the resource (issue #343).
- Now the resource can use built-in
PsDscRunAsCredential
instead of specifying theCredential
parameter (issue #367). - New parameter
SiteName
can be used to wait for a domain controller in a specific site in the domain. - Added comment-based help (issue #341).
- Changes to ADDomainController
- BREAKING CHANGE: Renamed the parameter
DomainAdministratorCredential
toCredential
to better indicate that it is possible to impersonate any credential with enough permission to perform the task (issue #269). - Add support for creating Read-Only Domain Controller (RODC) (issue #40). Svilen @SSvilen
- Refactored unit tests for Test-TargetResource.
- Added new parameter
FlexibleSingleMasterOperationRole
to able to move Flexible Single Master Operation (FSMO) roles to the current node. It does not allow seizing of roles, only allows a move when both domain controllers are available (issue #55).
- BREAKING CHANGE: Renamed the parameter
- Changes to ADObjectPermissionEntry
- Remove remnants of the
SupportsShouldProcess
(issue #329).
- Remove remnants of the
- Changes to ADGroup
- Added comment-based help (issue #338).
- Update the documentation with the correct default value for the parameter GroupScope.
- Changes to ADDomainDefaultPasswordPolicy
- Added comment-based help (issue #336).
3.0.0.0
- Changes to xActiveDirectory
- Added new helper functions in xADCommon, see each functions comment-based
help for more information.
- Convert-PropertyMapToObjectProperties
- Compare-ResourcePropertyState
- Test-DscPropertyState
- Move the examples in the README.md to Examples folder.
- Fix Script Analyzer rule failures.
- Opt-in to the following DSC Resource Common Meta Tests:
- Common Tests - Custom Script Analyzer Rules
- Common Tests - Required Script Analyzer Rules
- Common Tests - Flagged Script Analyzer Rules
- Common Tests - Validate Module Files (issue #282)
- Common Tests - Validate Script Files (issue #283)
- Common Tests - Relative Path Length (issue #284)
- Common Tests - Validate Markdown Links (issue #280)
- Common Tests - Validate Localization (issue #281)
- Common Tests - Validate Example Files (issue #279)
- Common Tests - Validate Example Files To Be Published (issue #311)
- Move resource descriptions to Wiki using auto-documentation (issue #289)
- Move helper functions from MSFT_xADCommon to the module
xActiveDirectory.Common (issue #288).
- Removed helper function
Test-ADDomain
since it was not used. The helper function had design flaws too. - Now the helper function
Test-Members
outputs all the members that are not in desired state when verbose output is enabled.
- Removed helper function
- Update all unit tests to latest unit test template.
- Deleted the obsolete xActiveDirectory_TechNetDocumentation.html file.
- Added new resource xADObjectEnabledState. This resource should be
used to enforce the
Enabled
property of computer accounts. This resource replaces the deprecatedEnabled
property in the resource xADComputer. - Cleanup of code
- Removed semicolon throughout where it is not needed.
- Migrate tests to Pester syntax v4.x (issue #322).
- Removed
-MockWith {}
in unit tests. - Use fully qualified type names for parameters and variables (issue #374).
- Removed unused legacy test files from the root of the repository.
- Updated Example List README with missing resources.
- Added missing examples for xADReplicationSubnet, xADServicePrincipalName and xWaitForADDomain (issue #395).
- Added new helper functions in xADCommon, see each functions comment-based
help for more information.
- Changes to xADComputer
- Refactored the resource and the unit tests.
- BREAKING CHANGE: The
Enabled
property is DEPRECATED and is no longer set or enforces with this resource. If this parameter is used in a configuration a warning message will be outputted saying that theEnabled
parameter has been deprecated. The new resource xADObjectEnabledState can be used to enforce theEnabled
property. - BREAKING CHANGE: The default value of the enabled property of the
computer account will be set to the default value of the cmdlet
New-ADComputer
. - A new parameter was added called
EnabledOnCreation
that will control if the computer account is created enabled or disabled. - Moved examples from the README.md to separate example files in the Examples folder.
- Fix the RestoreFromRecycleBin description.
- Fix unnecessary cast in
Test-TargetResource
(issue #295). - Fix ServicePrincipalNames property empty string exception (issue #382).
- Changes to xADGroup
- Change the description of the property RestoreFromRecycleBin.
- Code cleanup.
- Changes to xADObjectPermissionEntry
- Change the description of the property IdentityReference.
- Fix failure when applied in the same configuration as xADDomain.
- Localize and Improve verbose messaging.
- Code cleanup.
- Changes to xADOrganizationalUnit
- Change the description of the property RestoreFromRecycleBin.
- Code cleanup.
- Fix incorrect verbose message when this resource has Ensure set to Absent (issue #276).
- Changes to xADUser
- Change the description of the property RestoreFromRecycleBin.
- Added ServicePrincipalNames property (issue #153).
- Added ChangePasswordAtLogon property (issue #246).
- Code cleanup.
- Added LogonWorkstations property
- Added Organization property
- Added OtherName property
- Added AccountNotDelegated property
- Added AllowReversiblePasswordEncryption property
- Added CompoundIdentitySupported property
- Added PasswordNotRequired property
- Added SmartcardLogonRequired property
- Added ProxyAddresses property (Issue #254).
- Fix Password property being updated whenever another property is changed (issue #384).
- Replace Write-Error with the correct helper function (Issue #331).
- Changes to xADDomainController
- Change the
#Requires
statement in the Examples to require the correct module. - Suppressing the Script Analyzer rule
PSAvoidGlobalVars
since the resource is using the$global:DSCMachineStatus
variable to trigger a reboot. - Code cleanup.
- Change the
- Changes to xADDomain
- Suppressing the Script Analyzer rule
PSAvoidGlobalVars
since the resource is using the$global:DSCMachineStatus
variable to trigger a reboot. - Code cleanup.
- Suppressing the Script Analyzer rule
- Changes to xADDomainTrust
- Replaced New-TerminatingError with Standard Function.
- Code cleanup.
- Changes to xWaitForADDomain
- Suppressing the Script Analyzer rule
PSAvoidGlobalVars
since the resource is using the$global:DSCMachineStatus
variable to trigger a reboot. - Added missing property schema descriptions (issue #369).
- Code cleanup.
- Suppressing the Script Analyzer rule
- Changes to xADRecycleBin
- Remove unneeded example and resource designer files.
- Added missing property schema descriptions (issue #368).
- Code cleanup.
- It now sets back the
$ErrorActionPreference
that was set prior to setting it to'Stop'
. - Replace Write-Error with the correct helper function (issue #327).
- Changes to xADReplicationSiteLink
- Fix ADIdentityNotFoundException when creating a new site link.
- Code cleanup.
- Changes to xADReplicationSubnet
- Remove
{ *Present* | Absent }
from the property schema descriptions which were causing corruption in the Wiki documentation.
- Remove
- Changes to xADServicePrincipalNames
- Remove
{ *Present* | Absent }
from the property schema descriptions which were causing corruption in the Wiki documentation.
- Remove
- Changes to xADDomainDefaultPasswordPolicy
- Code cleanup.
- Changes to xADForestProperties
- Minor style cleanup.
- Changes to xADReplicationSubnet
- Code cleanup.
- Changes to xADKDSKey
- Code cleanup.
- Changes to xADManagedServiceAccount
- Code cleanup.
- Changes to xADServicePrincipalName
- Code cleanup.
2.26.0.0
- Changes to xActiveDirectory
- Added localization module -DscResource.LocalizationHelper* containing
the helper functions
Get-LocalizedData
,New-InvalidArgumentException
,New-InvalidOperationException
,New-ObjectNotFoundException
, andNew-InvalidResultException
(issue #257). For more information around these helper functions and localization in resources, see Localization section in the Style Guideline. - Added common module DscResource.Common containing the helper function
Test-DscParameterState
. The goal is that all resource common functions are moved to this module (functions that are or can be used by more than one resource) (issue #257). - Added xADManagedServiceAccount resource to manage Managed Service Accounts (MSAs). Andrew Wickham (@awickham10) and @kungfu71186
- Removing the Misc Folder, as it is no longer required.
- Added xADKDSKey resource to create KDS Root Keys for gMSAs. @kungfu71186
- Combined DscResource.LocalizationHelper and DscResource.Common Modules into xActiveDirectory.Common
- Added localization module -DscResource.LocalizationHelper* containing
the helper functions
- Changes to xADReplicationSiteLink
- Make use of the new localization helper functions.
- Changes to xAdDomainController
- Added new parameter to disable or enable the Global Catalog (GC) (issue #75). Eric Foskett @Merto410
- Fixed a bug with the parameter
InstallationMediaPath
that it would not be added if it was specified in a configuration. Now the parameterInstallationMediaPath
is correctly passed toInstall-ADDSDomainController
. - Refactored the resource with major code cleanup and localization.
- Updated unit tests to latest unit test template and refactored the tests for the function 'Set-TargetResource'.
- Improved test code coverage.
- Changes to xADComputer
- Restoring a computer account from the recycle bin no longer fails if
there is more than one object with the same name in the recycle bin.
Now it uses the object that was changed last using the property
whenChanged
(issue #271).
- Restoring a computer account from the recycle bin no longer fails if
there is more than one object with the same name in the recycle bin.
Now it uses the object that was changed last using the property
- Changes to xADGroup
- Restoring a group from the recycle bin no longer fails if there is
more than one object with the same name in the recycle bin. Now it
uses the object that was changed last using the property
whenChanged
(issue #271).
- Restoring a group from the recycle bin no longer fails if there is
more than one object with the same name in the recycle bin. Now it
uses the object that was changed last using the property
- Changes to xADOrganizationalUnit
- Restoring an organizational unit from the recycle bin no longer fails
if there is more than one object with the same name in the recycle bin.
Now it uses the object that was changed last using the property
whenChanged
(issue #271).
- Restoring an organizational unit from the recycle bin no longer fails
if there is more than one object with the same name in the recycle bin.
Now it uses the object that was changed last using the property
- Changes to xADUser
- Restoring a user from the recycle bin no longer fails if there is
more than one object with the same name in the recycle bin. Now it
uses the object that was changed last using the property
whenChanged
(issue #271).
- Restoring a user from the recycle bin no longer fails if there is
more than one object with the same name in the recycle bin. Now it
uses the object that was changed last using the property
2.25.0.0
- Added xADReplicationSiteLink
- New resource added to facilitate replication between AD sites
- Updated xADObjectPermissionEntry to use
AD:
which is more generic when usingGet-Acl
andSet-Acl
than usingMicrosoft.ActiveDirectory.Management\ActiveDirectory:://RootDSE/
- Changes to xADComputer
- Minor clean up of unit tests.
- Changes to xADUser
- Added TrustedForDelegation parameter to xADUser to support enabling/disabling Kerberos delegation
- Minor clean up of unit tests.
- Added Ensure Read property to xADDomainController to fix Get-TargetResource return bug (issue #155).
- Updated readme and add release notes
- Updated xADGroup to support group membership from multiple domains (issue #152). Robert Biddle (@robbiddle) and Jan-Hendrik Peters (@nyanhp)
2.24.0.0
- Added parameter to xADDomainController to support InstallationMediaPath (issue #108).
- Updated xADDomainController schema to be standard and provide Descriptions.
2.23.0.0
- Explicitly removed extra hidden files from release package
2.22.0.0
- Add PasswordNeverResets parameter to xADUser to facilitate user lifecycle management
- Update appveyor.yml to use the default template.
- Added default template files .gitattributes, and .gitignore, and .vscode folder.
- Added xADForestProperties: New resource to manage User and Principal Name Suffixes for a Forest.
2.21.0.0
- Added xADObjectPermissionEntry
- New resource added to control the AD object permissions entries Claudio Spizzi (@claudiospizzi)
- Changes to xADCommon
- Assert-Module has been extended with a parameter ImportModule to also import the module (issue #218). Jan-Hendrik Peters (@nyanhp)
- Changes to xADDomain
- xADDomain makes use of new parameter ImportModule of Assert-Module in order to import the ADDSDeployment module (issue #218). Jan-Hendrik Peters (@nyanhp)
- xADComputer, xADGroup, xADOrganizationalUnit and xADUser now support restoring from AD recycle bin (Issue #221). Jan-Hendrik Peters (@nyanhp)
2.20.0.0
- Changes to xActiveDirectory
- Changed MSFT_xADUser.schema.mof version to "1.0.0.0" to match other resources (issue #190). thequietman44 (@thequietman44)
- Removed duplicated code from examples in README.md (issue #198). thequietman44 (@thequietman44)
- xADDomain is now capable of setting the forest and domain functional level (issue #187). Jan-Hendrik Peters (@nyanhp)
2.19.0.0
- Changes to xActiveDirectory
- Activated the GitHub App Stale on the GitHub repository.
- The resources are now in alphabetical order in the README.md (issue #194).
- Adding a Branches section to the README.md with Codecov badges for both master and dev branch (issue #192).
- xADGroup no longer resets GroupScope and Category to default values (issue #183).
- The helper function script file MSFT_xADCommon.ps1 was renamed to MSFT_xADCommon.psm1 to be a module script file instead. This makes it possible to report code coverage for the helper functions (issue #201).
2.18.0.0
- xADReplicationSite: Resource added.
- Added xADReplicationSubnet resource.
- Fixed bug with group members in xADGroup
2.17.0.0
- Converted AppVeyor.yml to use DSCResource.tests shared code.
- Opted-In to markdown rule validation.
- Readme.md modified resolve markdown rule violations.
- Added CodeCov.io support.
- Added xADServicePrincipalName resource.
2.16.0.0
- xAdDomainController: Update to complete fix for SiteName being required field.
- xADDomain: Added retry logic to prevent FaultException to crash in Get-TargetResource on subsequent reboots after a domain is created because the service is not yet running. This error is mostly occur when the resource is used with the DSCExtension on Azure.
2.15.0.0
- xAdDomainController: Fixes SiteName being required field.
2.14.0.0
- xADDomainController: Adds Site option.
- xADDomainController: Populate values for DatabasePath, LogPath and SysvolPath during Get-TargetResource.
2.13.0.0
- Converted AppVeyor.yml to pull Pester from PSGallery instead of Chocolatey
- xADUser: Adds 'PasswordAuthentication' option when testing user passwords to support NTLM authentication with Active Directory Certificate Services deployments
- xADUser: Adds descriptions to user properties within the schema file.
- xADGroup: Fixes bug when updating groups when alternate Credentials are specified.
2.12.0.0
- xADDomainController: Customer identified two cases of incorrect variables being called in Verbose output messages. Corrected.
- xADComputer: New resource added.
- xADComputer: Added RequestFile support.
- Fixed PSScriptAnalyzer Errors with v1.6.0.
2.11.0.0
- xWaitForADDomain: Made explicit credentials optional and other various updates
2.10.0.0
- xADDomainDefaultPasswordPolicy: New resource added.
- xWaitForADDomain: Updated to make it compatible with systems that don't have the ActiveDirectory module installed, and to allow it to function with domains/forests that don't have a domain controller with Active Directory Web Services running.
- xADGroup: Fixed bug where specified credentials were not used to retrieve existing group membership.
- xADDomain: Added check for Active Directory cmdlets.
- xADDomain: Added additional error trapping, verbose and diagnostic information.
- xADDomain: Added unit test coverage.
- Fixes CredentialAttribute and other PSScriptAnalyzer tests in xADCommon, xADDomain, xADGroup, xADOrganizationalUnit and xADUser resources.
2.9.0.0
- xADOrganizationalUnit: Merges xADOrganizationalUnit resource from the PowerShell gallery
- xADGroup: Added Members, MembersToInclude, MembersToExclude and MembershipAttribute properties.
- xADGroup: Added ManagedBy property.
- xADGroup: Added Notes property.
- xADUser: Adds additional property settings.
- xADUser: Adds unit test coverage.
2.8.0.0
- Added new resource: xADGroup
- Fixed issue with NewDomainNetbiosName parameter.
2.7.0.0
- Added DNS flush in retry loop
- Bug fixes in xADDomain resource
2.6.0.0
- Removed xDscResourceDesigner tests (moved to common tests)
2.5.0.0
- Updated xADDomainTrust and xADRecycleBin tests
2.4.0.0
- Added xADRecycleBin resource
- Minor fixes for xADUser resource
2.3
- Added xADRecycleBin.
- Modified xADUser to include a write-verbose after user is removed when Absent.
- Corrected xADUser to successfully create a disabled user without a password.
2.2
- Modified xAdDomain and xAdDomainController to support Ensure as Present / Absent, rather than True/False. Note: this may cause issues for existing scripts.
- Corrected return value to be a hashtable in both resources.
2.1.0.0
- Minor update: Get-TargetResource to use domain name instead of name.
2.0.0.0
- Updated release, which added the resource:
- xADDomainTrust
1.0.0.0
- Initial release with the following resources:
- xADDomain, xADDomainController, xADUser, and xWaitForDomain
Dependencies
- puppetlabs/pwshlib (>= 0.7.0 < 2.0.0)