Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Correct the use of SPServices to run the C2WTS. #78

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Correct the use of SPServices to run the C2WTS. #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
262da6d
Correct the use of SPServices to run the C2WTS.
SPDEVGUY Sep 3, 2021
64c3596
missed using common name, added
SPDEVGUY Sep 3, 2021
246ff49
Update MatchComputerName to fix issue with similarly named servers
SPDEVGUY Sep 3, 2021
fbc8d9e
$computersList can come in as an array, need to join it with ","
SPDEVGUY Sep 3, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion SP/Automation/AutoSPInstallerInput.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,12 +153,31 @@
</ServerRoles>
<!-- The ManagedAccounts section configures all accounts that will be added to SharePoint as managed accounts. -->
<ManagedAccounts>
<!-- The CommonName values should remain unchanged for these first 4 accounts; you can add additional managed accounts, but the script expects certain static values for the CommonName of these 4 managed accounts.
<!-- The CommonName values should remain unchanged for these first 5 accounts; you can add additional managed accounts, but the script expects certain static values for the CommonName of these 4 managed accounts.
If you are creating additional web applications, use a new account for each web application with a new common name, unless you are creating a large number
of web applications, in which case the additional memory consumption this requires outweighs the security benefits. -->
<ManagedAccount CommonName="spservice">
<Username>CONTOSO\SP_Services</Username>
<Password></Password>
</ManagedAccount>
<!--
The Claims to Windows Token Service requires special permissions on each server.

Member of Local Administrators (Handled by AutoSPInstaller)

The following is a manual process to be done by you, the API To adjust these is not yet available.

Local Security Policies (secpol.msc):
Act as part of the operating system.
Impersonate a user after authentication.
Log on as a service.

SharePoint will not automatically grant these for you, you must set them yourself.
This account is a HIGH privilege account and should be kept very safe.
-->
<ManagedAccount CommonName="spclaims">
<Username>CONTOSO\SP_Claims</Username>
<Password></Password>
</ManagedAccount>
<ManagedAccount CommonName="Portal">
<Username>CONTOSO\SP_PortalAppPool</Username>
Expand Down
36 changes: 20 additions & 16 deletions SP/Automation/AutoSPInstallerModule.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1759,9 +1759,9 @@ Function GetSecureFarmPassphrase ([xml]$xmlInput)
# Func: UpdateProcessIdentity
# Desc: Updates the account a specified service runs under to the general app pool account
# ====================================================================================
Function UpdateProcessIdentity ($serviceToUpdate)
{
$spservice = Get-SPManagedAccountXML $xmlInput -CommonName "spservice"
Function UpdateProcessIdentity ($serviceToUpdate, $managedAccountName = "spservice")
{
$spservice = Get-SPManagedAccountXML $xmlInput -CommonName $managedAccountName
# Managed Account
$managedAccountGen = Get-SPManagedAccount | Where-Object {$_.UserName -eq $($spservice.username)}
if ($managedAccountGen -eq $null) { Throw " - Managed Account $($spservice.username) not found" }
Expand Down Expand Up @@ -2489,7 +2489,7 @@ Function ConfigureSandboxedCodeService ([xml]$xmlInput)
Try
{
Write-Host -ForegroundColor White " - Starting Microsoft SharePoint Foundation Sandboxed Code Service..."
UpdateProcessIdentity $sandboxedCodeService
UpdateProcessIdentity -serviceToUpdate $sandboxedCodeService
$sandboxedCodeService.Update()
$sandboxedCodeService.Provision()
If (-not $?) {Throw " - Failed to start Sandboxed Code Service"}
Expand Down Expand Up @@ -3498,7 +3498,7 @@ Function CreateUserProfileServiceApplication ([xml]$xmlInput)
Write-Host -ForegroundColor White " - Deleting existing sync credentials timer job..."
$UPSCredentialsJob.Delete()
}
UpdateProcessIdentity $profileSyncService
UpdateProcessIdentity -serviceToUpdate $profileSyncService
$profileSyncService.Update()
Write-Host -ForegroundColor White " - Waiting for User Profile Synchronization Service..." -NoNewline
# Provision the User Profile Sync Service
Expand Down Expand Up @@ -4113,7 +4113,7 @@ Function CreateWebAnalyticsApp ([xml]$xmlInput)
$analyticsDataProcessingInstances = Get-SPServiceInstance | Where-Object {$_.GetType().ToString() -eq "Microsoft.Office.Server.WebAnalytics.Administration.WebAnalyticsServiceInstance"}
$analyticsDataProcessingInstance = $analyticsDataProcessingInstances | Where-Object {MatchComputerName $_.Server.Address $env:COMPUTERNAME}
If (-not $?) { Throw " - Failed to find Analytics Data Processing Service instance" }
UpdateProcessIdentity $analyticsDataProcessingInstance
UpdateProcessIdentity -serviceToUpdate $analyticsDataProcessingInstance
$analyticsDataProcessingInstance.Update()
Write-Host -ForegroundColor White " - Starting local Analytics Data Processing Service instance..."
$analyticsDataProcessingInstance.Provision()
Expand Down Expand Up @@ -4307,29 +4307,31 @@ Function ConfigureClaimsToWindowsTokenService ([xml]$xmlInput)
Write-Host -ForegroundColor White " - Starting $($claimsService.DisplayName)..."
if ($xmlInput.Configuration.Farm.Services.ClaimsToWindowsTokenService.UpdateAccount -eq $true)
{
UpdateProcessIdentity $claimsService
$claimsService.Update()
# Add C2WTS account (currently the generic service account) to local admins
# Add C2WTS account to local admins
$builtinAdminGroup = Get-AdministratorsGroup
$adminGroup = ([ADSI]"WinNT://$env:COMPUTERNAME/$builtinAdminGroup,group")
# This syntax comes from Ying Li (http://myitforum.com/cs2/blogs/yli628/archive/2007/08/30/powershell-script-to-add-remove-a-domain-user-to-the-local-administrators-group-on-a-remote-machine.aspx)
$localAdmins = $adminGroup.psbase.invoke("Members") | ForEach-Object {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}
$spservice = Get-SPManagedAccountXML $xmlInput -CommonName "spservice"
$spservice = Get-SPManagedAccountXML $xmlInput -CommonName "spclaims"
$managedAccountGen = Get-SPManagedAccount | Where-Object {$_.UserName -eq $($spservice.username)}
$managedAccountDomain,$managedAccountUser = $managedAccountGen.UserName -split "\\"
If (!($localAdmins -contains $managedAccountUser))
{
Write-Host -ForegroundColor White " - Adding $($managedAccountGen.Username) to local Administrators..."
([ADSI]"WinNT://$env:COMPUTERNAME/$builtinAdminGroup,group").Add("WinNT://$managedAccountDomain/$managedAccountUser")
}

UpdateProcessIdentity -serviceToUpdate $claimsService -managedAccountName "spclaims"
$claimsService.Update()
}
$claimsService.Provision()
$claimsService | Start-SPServiceInstance
If (-not $?) {throw " - Failed to start $($claimsService.DisplayName)"}
}
Catch
{
Throw " - An error occurred starting $($claimsService.DisplayName)"
Write-Output $_
Throw " - An error occurred starting $($claimsService.DisplayName)"
}
#Wait
Write-Host -ForegroundColor Cyan " - Waiting for $($claimsService.DisplayName)..." -NoNewline
Expand Down Expand Up @@ -4416,7 +4418,7 @@ Function ConfigureFoundationSearch ([xml]$xmlInput)
Try
{
$foundationSearchService = (Get-SPFarm).Services | Where-Object {$_.Name -eq "SPSearch4"}
UpdateProcessIdentity $foundationSearchService
UpdateProcessIdentity -serviceToUpdate $foundationSearchService
}
Catch
{
Expand Down Expand Up @@ -4472,7 +4474,7 @@ Function ConfigureTracing ([xml]$xmlInput)
}
Try
{
UpdateProcessIdentity $spTraceV4
UpdateProcessIdentity -serviceToUpdate $spTraceV4
}
Catch
{
Expand Down Expand Up @@ -4586,7 +4588,7 @@ Function ConfigureDistributedCacheService ([xml]$xmlInput)
Write-Host -ForegroundColor White " - Applying service account $($spservice.username) to service AppFabricCachingService..."
Try
{
UpdateProcessIdentity $distributedCachingSvc
UpdateProcessIdentity -serviceToUpdate $distributedCachingSvc
}
Catch
{
Expand Down Expand Up @@ -6481,7 +6483,7 @@ Function CreateProjectServerServiceApp ([xml]$xmlInput)
$projectServiceInstances = (Get-SPFarm).Services | Where-Object {$_.GetType().ToString() -eq $projectService}
foreach ($projectServiceInstance in $projectServiceInstances)
{
UpdateProcessIdentity $projectServiceInstance
UpdateProcessIdentity -serviceToUpdate $projectServiceInstance
}
}
# Create a Project Server DB (2013 only)
Expand Down Expand Up @@ -7720,7 +7722,9 @@ Function Get-SharePointInstall
# ===================================================================================
Function MatchComputerName ($computersList, $computerName)
{
If ($computersList -like "*$computerName*") { Return $true; }
$listString = $computersList
if ($computersList -is [array]) { $listString = $computersList -join "," }
If (",$($listString)," -like "*,$($computerName),*") { Return $true; }
foreach ($v in $computersList) {
If ($v.Contains("*") -or $v.Contains("#")) {
# wildcard processing
Expand Down