PortOfPortland / terraform-provider-windns

A Terraform provider for Microsoft Windows DNS
MIT License
39 stars 20 forks source link

Cannot delete records #21

Closed ryantho6 closed 2 years ago

ryantho6 commented 2 years ago

I'm using a service account and trying to do least privilege (not a domain admin). The service account is in 'dnsadmins' and can WinRM to the DC.

My current issue is:

Remove-DnsServerResourceRecord -ZoneName corp.com -RRType A -Name test05 -Force
Failed to remove resource record set by name test05 from zone corp.com on server DC01.
    + CategoryInfo          : PermissionDenied: (test05:root/Microsoft/...rResourceRecord) [Remove-DnsServerRe
   sourceRecord], CimException
    + FullyQualifiedErrorId : WIN32 5,Remove-DnsServerResourceRecord

I can run these commands via the service account remotely (using the -computername option), but not from a WinRM session on the DC. Any ideas?

The service account has full control over the zone. I've also already done the following to fix adding records (which is a previous issue I had):

1. Open Computer Management Console. Right click WMI Control (under Services and Applications) and click property.
2. In the newly open Window, click on Security tab.
3. Expand Root tree, and then click on the node CIMV2, and click the button security
4. In the newly open Window, click the button Advanced.
5. In the newly open Window, click the button Add under the permission tab.
6. In the newly open Window, click on “select a principal”, then search and add the group as the principal, then click ok.
7. In the applies to, choose “this namespace and subnamespace”.
8. For the permission, check on “Execute Methods”, “Enable Accounts” and “Remote Enable”
9. Click OK three times.
10. Then navigate to the node Root – Microsoft – Windows – DNS. Do the same things, add permission for the group.
11. Restart service “Windows Management Instrumentation. 
12. Check whether the issue is fixed.
ryantho6 commented 2 years ago

Nevermind.. this was only an issue when trying to emulate the commands manually (and not sure why). Via Terraform it worked fine.