Details of the scenario you tried and the problem that is occurring
The Increase_scheduling_priority User Rights Assignment has a default membership of BUILTIN\Administrators and Window Manager\Window Manager Group.
When trying to modify the Increase_scheduling_priority policy on Windows Server Core, the following error occurs:
Could not translate SID: S-1-5-90-0 on Policy: Increase_scheduling_priority
Verbose logs showing the problem
VERBOSE: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = ResourceSet,'className' =
MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: An LCM method call arrived from computer DC01-2019 with user sid
S-1-5-21-3553084080-2500667019-4197401787-500.
VERBOSE: [DC01-2019]: LCM: [ Start Set ] [[UserRightsAssignment]DirectResourceAccess]
VERBOSE: [DC01-2019]: [[UserRightsAssignment]DirectResourceAccess] Could not translate SID:
S-1-5-90-0 on Policy: Increase_scheduling_priority
VERBOSE: [DC01-2019]: [[UserRightsAssignment]DirectResourceAccess] Policy:
Increase_scheduling_priority. Identity: BUILTIN\Administrators S-1-5-90-0
VERBOSE: [DC01-2019]: LCM: [ End Set ] [[UserRightsAssignment]DirectResourceAccess] in 0.4680 seconds.
PowerShell DSC resource MSFT_UserRightsAssignment failed to execute Set-TargetResource functionality with error
message: Could not translate SID: S-1-5-90-0 on Policy: Increase_scheduling_priority
+ CategoryInfo : InvalidOperation: (root/Microsoft/...gurationManager:String) [], CimException
+ FullyQualifiedErrorId : ProviderOperationExecutionFailure
+ PSComputerName : localhost
VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Time taken for configuration job to complete is 0.852 seconds
Suggested solution to the issue
This is caused by the SecurityPolicyDsc internal function ConvertTo-NTAccount attempting to convert the S-1-5-90-0 SID to a friendly name, but fails as this group (Window Manager\Window Manager Group) does not exist on Windows Server Core.
To avoid this failure, mapping of this particular SID to its friendly name needs to be coded into the function.
The DSC configuration that is used to reproduce the issue (as detailed as possible)
Details of the scenario you tried and the problem that is occurring
The
Increase_scheduling_priority
User Rights Assignment has a default membership ofBUILTIN\Administrators
andWindow Manager\Window Manager Group
.When trying to modify the
Increase_scheduling_priority
policy on Windows Server Core, the following error occurs:Verbose logs showing the problem
Suggested solution to the issue
This is caused by the
SecurityPolicyDsc
internal functionConvertTo-NTAccount
attempting to convert theS-1-5-90-0
SID to a friendly name, but fails as this group (Window Manager\Window Manager Group
) does not exist on Windows Server Core.To avoid this failure, mapping of this particular SID to its friendly name needs to be coded into the function.
The DSC configuration that is used to reproduce the issue (as detailed as possible)
The operating system the target node is running
Version and build of PowerShell the target node is running
Version of the DSC module that was used