Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Computer] Join AD domain succeeds but it throws error "The user name or password is incorrect" #413

Open
Yvand opened this issue Jun 15, 2023 · 3 comments
Labels
bug The issue is a bug. help wanted The issue is up for grabs for anyone in the community.

Comments

@Yvand
Copy link

Yvand commented Jun 15, 2023

Problem description

Scenario: VM is in a workgroup and wants to join an AD domain for the 1st time:
It successfully joins the AD domain, but DSC throws the following error:
Exception calling "FindOne" with "0" argument(s): "The user name or password is incorrect."

This is thrown by DirectorySearcher.FindOne() in function Get-ADSIComputer :

Verbose logs

VERBOSE: [2023-06-15 08:29:26Z] [VERBOSE] [SP]: LCM:  [ Start  Set      ]  [[Computer]JoinDomain]
VERBOSE: [2023-06-15 08:29:26Z] [VERBOSE] [SP]:                            [[Computer]JoinDomain] Setting computer 
state for 'SP'.
VERBOSE: [2023-06-15 08:29:26Z] [VERBOSE] [SP]:                            [[Computer]JoinDomain] Perform operation 
'Enumerate CimInstances' with following parameters, ''namespaceName' = root\cimv2,'className' = Win32_ComputerSystem'.
VERBOSE: [2023-06-15 08:29:26Z] [VERBOSE] [SP]:                            [[Computer]JoinDomain] Operation 'Enumerate CimInstances' complete.
VERBOSE: [2023-06-15 08:29:29Z] [ERROR] Exception calling "FindOne" with "0" argument(s): "The user name or password is incorrect."
VERBOSE: [2023-06-15 08:29:30Z] [WARNING] [SP]:                            [[Computer]JoinDomain] The changes will take effect after you restart the computer SP.
VERBOSE: [2023-06-15 08:29:30Z] [VERBOSE] [SP]:                            [[Computer]JoinDomain] Added computer to domain 'contoso.local'.
VERBOSE: [2023-06-15 08:29:30Z] [VERBOSE] [SP]: LCM:  [ End    Set      ]  [[Computer]JoinDomain]  in 3.8950 seconds.

DSC configuration

configuration ConfigureSQLVM
{
    param
    (
        [Parameter(Mandatory)] [String]$DomainFQDN,
        [Parameter(Mandatory)] [System.Management.Automation.PSCredential]$DomainAdminCreds
    )

    Import-DscResource -ModuleName ComputerManagementDsc -ModuleVersion 9.0.0

    [String] $DomainNetbiosName = (Get-NetBIOSName -DomainFQDN $DomainFQDN)
    [PSCredential] $DomainAdminCredsQualified = New-Object PSCredential ("${DomainNetbiosName}\$($DomainAdminCreds.UserName)", $DomainAdminCreds.Password)
    [String] $ComputerName = Get-Content env:computername

    Node localhost
    {
        Computer JoinDomain
        {
            Name       = $ComputerName
            DomainName = $DomainFQDN
            Credential = $DomainAdminCredsQualified
        }
    }
}

Suggested solution

I did not investigate the exact reason of the error message "The user name or password is incorrect.", but credentials are valid since VM joins the AD domain successfully.

A possible simple workaround would be to add a try catch:

try 
{
	return $searcher.FindOne()
}
catch
{
}

Operating system the target node is running

OsName               : Microsoft Windows Server 2022 Datacenter
OsOperatingSystemSKU : DatacenterServerEdition
OsArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 20348.1.amd64fre.fe_release.210507-1500
OsLanguage           : en-US
OsMuiLanguages       : {en-US}

PowerShell version and build the target node is running

Name                           Value
----                           -----
PSVersion                      5.1.20348.1366
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.20348.1366
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

ComputerManagementDsc version

Name                  Version Path
----                  ------- ----
ComputerManagementDsc 9.0.0   C:\Program Files\WindowsPowerShell\Modules\ComputerManagementDsc\ComputerManagementDsc.psd1
@Yvand Yvand changed the title [Computer] Join AD domain succeeds but it throws an error. [Computer] Join AD domain succeeds but it throws error "The user name or password is incorrect" Jun 15, 2023
@johlju
Copy link
Member

johlju commented Jun 15, 2023

Can you verify that it throws the same error if you use the fully qualified domain name instead of NetBios name, eg [email protected]

@johlju johlju added bug The issue is a bug. help wanted The issue is up for grabs for anyone in the community. labels Jun 15, 2023
@Yvand
Copy link
Author

Yvand commented Jun 16, 2023

@johlju I confirm it works fine if the username is in format [email protected]

@bdanse
Copy link

bdanse commented Sep 27, 2023

Safer solution might be to pickup username with $Credential.GetNetworkCredential().UserName this will only have the username. and not domain part if this was supplied in the credential object.

https://github.com/dsccommunity/ComputerManagementDsc/blob/438d2c29a938f1c4e2b5a1e916bd6205fd950c13/source/DSCResources/DSC_Computer/DSC_Computer.psm1#L733C1-L742C37

`
$params = @{
TypeName = 'System.DirectoryServices.DirectoryEntry'
ArgumentList = @(
$DomainName,
$Credential.GetNetworkCredential().UserName,
$Credential.GetNetworkCredential().password
)
ErrorAction = 'Stop'
}
$searchRoot = New-Object @params
$searcher.SearchRoot = $searchRoot

`

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug The issue is a bug. help wanted The issue is up for grabs for anyone in the community.
Projects
None yet
Development

No branches or pull requests

3 participants