PowerShell / JEA

Just Enough Administration
http://aka.ms/JEAdocs
MIT License
257 stars 60 forks source link

Changing Path before changing PSSessionConfiguration damages WinRM service #31

Open jnury opened 6 years ago

jnury commented 6 years ago

On Windows Server 2012 R2:

PS > $psversiontable

Name                           Value
----                           -----
PSVersion                      5.1.14409.1005
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14409.1005
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

WinRM will be (definitevly) damaged if you run the following script:

Configuration Config  {
    Param (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [String[]]
        $NodeName
    )

    Import-DSCResource -ModuleName 'PSDesiredStateConfiguration'

    Node $NodeName {

        Environment PathJava {
            Name      = "PATH"
            Value     = "%JAVA_HOME%\bin"
            Path      = $true
            Ensure    = "Present"
        }

        Script PSSessionConfig {
        SetScript = {
                $psscPath = "C:\TestJEA.pssc"
                $configurationFileArguments = @{
                    Path                = $psscPath
                    RoleDefinitions     = @{ 'Everyone' = @{ VisibleCmdlets = 'Get-*' } }
                    RunAsVirtualAccount = $true
                    SessionType         = 'RestrictedRemoteServer'
                }
                New-PSSessionConfigurationFile @configurationFileArguments
                Register-PSSessionConfiguration -Name 'TestJEA' -Path $psscPath
            }

            TestScript = {
                return $false
            }

            GetScript = {
                return @{ }
            }
        }
    }
}
Config -NodeName localhost 
Start-DscConfiguration -Path .\Config -Wait -Verbose

After that, WinRM service configuration seems to be corrupted and starting the service lead to that message: winrm

I did not find any way of getting the service back to life (except VM snapshot reverse ;-))