Unable to query for CIM_Service when setting Service Account in v3.2.0

spiskulaos commented 3 years ago

Hello,

I noticed that calls to Get-CimInstance CIM_Service were added to this Module in v3.2.0 about a month ago. This change seems to be causing issues with setting the Service Account. I try to use ArcGIS DSC 3.2.0 to configure my domain service account (the account works fine in v2.1.1 on Windows 2016) but the call to Get-CimInstance CIM_Service seems to crash with:

 CategoryInfo          : NotSpecified: (root\cimv2:CIM_Service:String) [Get-CimInstance], CimException
 FullyQualifiedErrorId : HRESULT 0x80041001,Microsoft.Management.Infrastructure.CimCmdlets.GetCimInstanceCommand

The issue was not present in v2.1.1, so I think this is due to rewrites that took place recently. Can I please ask for a suggestion what extra/different permissions/dependencies need to be assured for the Domain Service Account to run the CIM query successfully? I've tried the query for other ClassNames in isolation, like Get-CimInstance Win32_Process, and it works fine. The crash only happens for CIM_Service. Because the Domain Account works fine with ArcGIS DSC 2.1.1, it feels the Account needs specific permissions purely for the sake of changes introduced in ArcGIS DSC v3.2.0 internals, and not for running of ArcGIS Server itself.

https://github.com/Esri/arcgis-powershell-dsc/blob/78e488fc0aac6f8f4cdf574e1bdb50a7d39ed350/Modules/ArcGIS/DSCResources/ArcGIS_Service_Account/ArcGIS_Service_Account.psm1#L336

cameronkroeker commented 3 years ago

Hi @spiskulaos,

This is interesting that Get-CimInstance is failing with CIM_Service class, but works when using Win32_Service class.

Do both, CIM_Service and Win32_Service, classes show up when running the following command:

PS C:\Users\arcgis> Get-CimClass *Service | select CimClassName

CimClassName
------------
MSFT_NetDependOnLaterService
CIM_Service
Win32_BaseService
Win32_Service
Win32_TerminalService
CIM_BootService
CIM_ClusteringService
Win32_ApplicationService
CIM_HostedService
CIM_HostedBootService
Win32_DependentService
SoftwareLicensingService
Win32_ServiceSpecificationService
Win32_PerfFormattedData_Counters_HTTPService
Win32_PerfRawData_Counters_HTTPService
Win32_PerfFormattedData_Counters_HyperVDynamicMemoryIntegrationService
Win32_PerfRawData_Counters_HyperVDynamicMemoryIntegrationService
Win32_PerfFormattedData_MicrosoftWindowsW32TimePerf_WindowsTimeService
Win32_PerfRawData_MicrosoftWindowsW32TimePerf_WindowsTimeService

I am not quite sure what permissions/dependencies are needed/missing in this case but if I come across something I will surely let you know.

Perhaps one possible workaround to try for v3.2.0 is to search for CIM_Service and replace it with Win32_Service.

I believe there are 7 locations in /Modules/ArcGIS/DSCResources/ArcGIS_Service_Account/ArcGIS_Service_Account.psm1:

And 2 locations in /Modules/ArcGIS/Configurations-OnPrem/Upgrades/DataStoreUpgradeInstall.ps1

Thanks, Cameron K.

HakonD commented 3 years ago

We ran into this problem on several servers in Azure after the windows update last Thursday and we are now not able to run the configure step of a server install.

Executing Get-CimInstance CIM_Service list several services, before throwing the exception:

cameronkroeker commented 3 years ago

We ran into this problem on several servers in Azure after the windows update last Thursday and we are now not able to run the configure step of a server install.

Executing Get-CimInstance CIM_Service list several services, before throwing the exception:

Interesting, I wonder if there is a specific Windows Update that causes an issue with using CIM_Service class with the Get-CimInstance method.

For anyone who may be running into these issues, one way to confirm is by running the following command:

Get-CimInstance CIM_Service -filter "Name='ArcGIS Server'"

If this fails with the "generic failure" error message above then try using the Win32_Service class instead:

Get-CimInstance Win32_Service -filter "Name='ArcGIS Server'"

This should succeed. If it succeeds then try the following workaround:

search for CIM_Service and replace it with Win32_Service.

There are 7 locations in /Modules/ArcGIS/DSCResources/ArcGIS_Service_Account/ArcGIS_Service_Account.psm1:

And 2 locations in /Modules/ArcGIS/Configurations-OnPrem/Upgrades/DataStoreUpgradeInstall.ps1

Thanks, Cameron K.

HakonD commented 3 years ago

The workaround works ok. Changed to Win32_Service and ran a full install of a GeoEvent server now.

thanks Håkon

scma-esrich commented 3 years ago

We have the same issue with a customer. We tested and reproduced the behavior on Windows Server 2016 and Windows Server 2019. I did multiple successful upgrades with the module-version 3.2.0 on some of the tested Windows Server-environments, in the 2-3 weeks after the 10.9.0/3.2.0-release. Hence, it looks like an issue introduced with a Microsoft-patch to me, too.

The workaround is tested by a customer right now.

cameronkroeker commented 3 years ago

@HakonD @scma-esrich @spiskulaos

By chance is the Print Spooler service in Windows services.msc stopped?

I notice when the Print Spooler service is started the query works fine:

PS C:\Users\madmin\Desktop> Get-CimInstance CIM_Service -filter "Name='ArcGIS Server'"

ProcessId Name          StartMode State   Status ExitCode
--------- ----          --------- -----   ------ --------
0         ArcGIS Server Manual    Stopped OK     1077

But when the Print Spooler Service is stopped it fails with:

PS C:\Users\madmin\Desktop> Get-CimInstance CIM_Service -filter "Name='ArcGIS Server'"
Get-CimInstance : Generic failure
At line:1 char:1
+ Get-CimInstance CIM_Service -filter "Name='ArcGIS Server'"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-CimInstance], CimException
    + FullyQualifiedErrorId : HRESULT 0x80041001,Microsoft.Management.Infrastructure.CimCmdlets.GetCimInstanceCommand

Thanks, Cameron K.

scma-esrich commented 3 years ago

@cameronkroeker: On my customer's system the Print Spooler-service is not running and is also "Disabled". They do not intend to "Enable" it either.

HakonD commented 3 years ago

@cameronkroeker Same here, Print spooler is stopped on all servers in the environment and I don't think enabling it for the installation is a viable option. Anyway, I guess we can conclude that the root cause here is a Windows issue, and who knows when it will be fixed.

Do you see any drawbacks using win32_service instead?

cameronkroeker commented 3 years ago

Thanks @HakonD and @scma-esrich for confirming this to be the case. I do not see any drawbacks with using win32_service class instead. In fact, this is the solution we will be implementing in the next release.

spiskulaos commented 3 years ago

Hi @cameronkroeker, ArcGIS Server 10.9.1 is soon to be released. For the DSC to support it some changes will need to be done to include product code guids etc. Is there any chance please that with that work, resolution to this issue #331 is included since it seems like a small text replacement operation please?

cameronkroeker commented 3 years ago

Hi @cameronkroeker, ArcGIS Server 10.9.1 is soon to be released. For the DSC to support it some changes will need to be done to include product code guids etc. Is there any chance please that with that work, resolution to this issue #331 is included since it seems like a small text replacement operation please?

Hi @spiskulaos,

Yes, this will be fixed in the next release.

Thanks, Cameron K.

cameronkroeker commented 3 years ago

Hello @HakonD and @HakonD,

This issue has been addressed in the latest release, v3.3.0:

https://github.com/Esri/arcgis-powershell-dsc/releases/tag/v3.3.0

Thanks, Cameron K.

Esri / arcgis-powershell-dsc

Unable to query for CIM_Service when setting Service Account in v3.2.0 #331