Steps to deploy a domain controller

[JLBTurtle]

I've tried to add a DC to a build. I haven't had any luck. I always hit some form of errors. So I'm trying to start from scratch with a fresh clone of the repository and doing a build just to make sure everything goes well.

• I copied the node Dev\DSCFile01.yml and created Dev\DSCDC01.yml
• I changed Role from FileServer to DomainController
• I updated the IP Address
• I coppied AddsDomain, AddsDomainController from CommonTasks to the DscConfig.Demo DSCResources folder (I had previously made changed to replace DscConfig.demo with common tasks, but this time I want to start simple and change as little as possible till I get the hang of things)
• I updated PSGetModuleInfo.xml in DscConfig.demo to include AddsDomain, AddsDomainController just in case.

When I run the build.ps1 it gets to COMPILEROOTCONFIGURATION and starts preloading available resources

Preloading available resources
---------------------------------------------------------------------------
DSCFile02 : DSCFile02 : MOF__ NA
DSCFile02 : FileServer ::> FileSystemObjects ...................................................OK
DSCFile02 : FileServer ::> RegistryValues ......................................................OK
DSCFile02 : FileServer ::> SecurityBase ........................................................OK
DSCFile02 : FileServer ::> WindowsFeatures .....................................................OK
DSCFile02 : FileServer ::> ComputerSettings ....................................................OK
DSCFile02 : FileServer ::> NetworkIpConfiguration ..............................................OK
DSCFile02 : FileServer ::> WindowsEventLogs ....................................................OK
DSCFile02 : FileServer ::> DscTagging ..........................................................OK
---------------------------------------------------------------------------
DSCDC01 : DSCDC01 : MOF__ NA
DSCDC01 : DomainController ::> FileSystemObjects ...............................................OK
DSCDC01 : DomainController ::> AddsDomain ......................................................OK
cmdlet AddsDomainController at command pipeline position 1
Supply values for the following parameters:
DomainName: LAB
Credential
SafeModeAdministratorPassword
DSCDC01 : DomainController ::> AddsDomainController ............................................OK
DSCDC01 : DomainController ::> SecurityBase ....................................................OK
DSCDC01 : DomainController ::> WindowsFeatures .................................................OK
DSCDC01 : DomainController ::> ComputerSettings ................................................OK
DSCDC01 : DomainController ::> NetworkIpConfiguration ..........................................OK
DSCDC01 : DomainController ::> WindowsEventLogs ................................................OK
DSCDC01 : DomainController ::> DscTagging ......................................................OK

What I find interesting is it's prompting me for domain information instead of pulling it from datum. The other thing I find interesting it fails and starts erroring out there saying SafeModeAdministratorPassword = $Parameters['SafeModeAdministratorPassword'] ' required by '[WindowsFeature]ADDS::[AddsDomainController]AddsDomainController' does not exist. Please ensure that the required resource exists and the name is properly formed. At C:\windows\system32\windowspowershell\v1.0\Modules\PSDesiredStateConfiguration\PSDesiredStateConfiguration.psm1:1049 char:17

Does anyone have a sample build that works with a basic setup of a domain controller ?

[raandree]

Right, we need to add some some documentation to DomainController role as it does not work out of the box.

@JLBTurtle, very well done, just a tiny bit was missing. When following your steps I get the same error when calling Get-DscResource -Name AddsDomainController.

Write-Error: The term 'AddsDomainController' is not recognized as the name of a Resource.

---

• I copied the node Dev\DSCFile01.yml and created Dev\DSCDC01.yml ✅
• I changed Role from FileServer to DomainController ✅
• I updated the IP Address ✅
• I coppied AddsDomain, AddsDomainController from CommonTasks to the DscConfig.Demo DSCResources folder ✅
  I updated PSGetModuleInfo.xml in DscConfig.demo to include AddsDomain, AddsDomainController just in case. 👎 (This is not necessary. The file PSGetModuleInfo.xml stores metadata so that PowerShellGet / PackageManagement knows where the module comes from. In this context, the file can even be deleted).
• The missing step: The Adds* resources use the DSC resources in the module ActiveDirectoryDsc (Import-DscResource -ModuleName ActiveDirectoryDsc). You need to add the ActiveDirectoryDsc module to the RequiredModules.psd1. For a quick test, just call Save-Module -Name ActiveDirectoryDsc -Path .\output\RequiredModules.

Please let us know if this works for you.

[JLBTurtle]

Thank you @raandree . I got a DC deployed.

Now I am hitting issues with FileSystemObjects. I was hitting an error about FileSystemObject was not found in FileSystemDsc (I can't recall the exact error to reproduce)

Reviewing the documentation I noticed it refers to FilesAndFolders and not FileSystemObject(s). So I tried updating some of the files with FilesAndFolders in the yml files and i'm getting mixed results. Should I be using FileSystemObject or FilesAndFolders? I can revert the files I changed and run again to get you the exact error.

[raandree]

The configuration / composite resource FilesAndFolders requires PowerShell 5 for compiling the MOF files. To move the DscWorkshop to PowerShell 7, we did not move this configuration to DscConfig.Demo but created a new one. FileSystemObjects uses FileSystemDsc. If you want to do the build on PowerShell 5, you can use the FilesAndFolders.

[JLBTurtle]

I'll have to test things out.

I've been trying to build out my DomainController.yml role and added AddsSiteSubnets to rename the default site which worked well. So I thought I would try adding some OUs. I added

AddsOrgUnitsAndGroups:
  DomainDN: '[x={ $Datum.Global.Domain.DomainDn }=]'
  OrgUnits:
    - Name: 'Test Lab'
      Path: '[x={ $Datum.Global.Domain.DomainDn }=]'
      ChildOu:
        - Name: 'Exchange Attributes'
        - Name: 'Security Groups'
        - Name: 'Servers'
        - Name: 'Service Accounts'
        - Name: 'Users'
        - Name: 'Workstations'
  Groups:
    - GroupName: Administrators
      Description: Lab Administrators

Now i'm getting errors again

Transcript started, output file is output\Logs\CompileRootConfiguration.log

Did not find 'RootConfiguration.ps1' and 'CompileRootConfiguration.ps1' in 'source', using the ones in 'Sampler.DscPipeline'
RootConfiguration will import these composite resource modules as defined in 'build.yaml':
        - PSDesiredStateConfiguration
        - DscConfig.Demo

Preloading available resources


---------------------------------------------------------------------------
DSCDC01 : DSCDC01 : MOF__ NA
    DSCDC01 : DomainController ::> FileSystemObjects ...............................................OK
    DSCDC01 : DomainController ::> AddsDomain ......................................................OK
    DSCDC01 : DomainController ::> AddsDomainController ............................................OK
    DSCDC01 : DomainController ::> AddsOrgUnitsAndGroups ...........................................OK
    DSCDC01 : DomainController ::> AddsSitesSubnets ................................................OK
    DSCDC01 : DomainController ::> SecurityBase ....................................................OK
    DSCDC01 : DomainController ::> WindowsFeatures .................................................OK
    DSCDC01 : DomainController ::> ComputerSettings ................................................OK
    DSCDC01 : DomainController ::> NetworkIpConfiguration ..........................................OK
    DSCDC01 : DomainController ::> WindowsEventLogs ................................................OK
    DSCDC01 : DomainController ::> DscTagging ......................................................OK
Error occured during compilation of node '' : Compilation errors occurred while processing configuration 'RootConfiguration'. Please review the errors reported in error stream and modify your configuration code appropriately.
Error(s) occured during the compilation. Details will be shown below
Transcript stopped, output file is C:\Software\PowerShell\Dsc\DscWorkshop\output\Logs\CompileRootConfiguration.log
ERROR: Compilation errors occurred while processing configuration 'RootConfiguration'. Please review the errors reported in error stream and modify your configuration code appropriately.
At C:\Software\PowerShell\Dsc\DscWorkshop\output\RequiredModules\Sampler.DscPipeline\0.2.0\tasks\CompileRootConfiguration.build.ps1:44 char:1
+ task CompileRootConfiguration {
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Build FAILED. 14 tasks, 1 errors, 0 warnings 00:00:18.2247682
C:\Software\PowerShell\Dsc\DscWorkshop\output\RequiredModules\InvokeBuild\5.12.1\Invoke-Build.ps1 : Compilation errors occurred while processing configuration
'RootConfiguration'. Please review the errors reported in error stream and modify your configuration code appropriately.
At C:\Software\PowerShell\Dsc\DscWorkshop\build.ps1:540 char:9
+         Invoke-Build @PSBoundParameters -Task $Tasks -File $MyInvocat ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (RootConfiguration:String) [Write-Error], InvalidOperationException
    + FullyQualifiedErrorId : FailToProcessConfiguration,Invoke-Build.ps1

I'm not entirely sure why. I figured at first maybe it was syntax in my yml file. But digging through the $Errror variable I found this

Test-ConflictingResources : A conflict was detected between resources '[WaitForADDomain]WaitForestAvailability::[AddsDomainController]AddsDomainController (C:\Software\Po
werShell\Dsc\DscWorkshop\output\RequiredModules\DscConfig.Demo\0.8.3\DSCResources\AddsDomainController\AddsDomainController.schema.psm1::60::5::WaitForADDomain)' and
'[WaitForADDomain]Domain::[AddsOrgUnitsAndGroups]AddsOrgUnitsAndGroups (C:\Software\PowerShell\Dsc\DscWorkshop\output\RequiredModules\DscConfig.Demo\0.8.3\DSCResources\Ad
dsOrgUnitsAndGroups\AddsOrgUnitsAndGroups.schema.psm1::25::5::WaitForADDomain)' in node 'DSCDC01'. Resources have identical key properties but there are differences in
the following non-key properties: 'Credential'. Values 'System.Management.Automation.PSCredential' don't match values 'NULL'. Please update these property values so that
they are identical in both cases.
At line:289 char:9
+         Test-ConflictingResources $keywordName $canonicalizedValue $k ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Write-Error], InvalidOperationException
    + FullyQualifiedErrorId : ConflictingDuplicateResource,Test-ConflictingResources

Should that have popped up in a Pester test?

[JLBTurtle]

Just cleared $Error and ran build.ps1 again. I get 16 errors in the variable.. 13 of them are

Get-ItemProperty : Cannot find path 'HKLM:\SOFTWARE\Microsoft\PowerShell\3\DSC' because it does not exist.
At C:\windows\system32\windowspowershell\v1.0\Modules\PSDesiredStateConfiguration\PSDesiredStateConfiguration.psm1:614 char:32
+ ...      $reg = Get-ItemProperty -path $key -name "PSDscAllowDomainUser"  ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (HKLM:\SOFTWARE\...owerShell\3\DSC:String) [Get-ItemProperty], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetItemPropertyCommand

Should these registry keys exist? I know tis is the PSDesiredStateConfiguraiton module and not the workshop one. Just curious if maybe my computer is not in a good state.

[raandree]

Sorry for the delay. The error Get-ItemProperty : Cannot find path 'HKLM:\SOFTWARE\Microsoft\PowerShell\3\DSC' because it does not exist is something that DSC silently throws internally. It is not the cause of your issue.

In your config you have a conflict with two resources of type WaitForestAvailability. Have you solved the issue already yourself in the meantime?

[JLBTurtle]

Yeah, I think I got things working. I ended up creating 2 different domain controller roles. 1 for the initial domain controller that creates the forest, I put my configurations for OU structure, and AD related stuff here. Then I have a more simple join to domain controller role. I worked out a few things and now I can deploy 2 domain controllers. I'll wipe the lab and retry. I think the issue I was having with that and another server was it didn't like getting the computers container passed for the domain join. Which I wanted to change that to a Servers OU anyways. I'll follow up. Now moving onto trying to deploy an Exchange Server as part of my lab :D

[raandree]

Exchange might not be easy. The module wasn't updated since 2023. There was a major issue with the November 2023 SU and I was quite surprised that there was so little noise about this. Check out dsccommunity/ExchangeDsc#500.