Logon failure: the user has not been granted the requested logon type at this computer

smareano commented 5 years ago

Error occurred during SQL Install on Windows Failover Cluster envt using Desired State Configuration. Used my own domain account for install and have access to log on locally. Any help appreciated. Thanks!

johlju commented 5 years ago

Need a bit more information, could you please provide the configuration you are using, and the verbose logs showing the problem when you run the configuration. For example

Start-DscConfiguration -Wait -Verbose

Obfuscate any sensitive information.

smareano commented 5 years ago

Thank you for your quick response. here is the part of the config log on failure showing up

    SQLSetup 'InstallClusterFirstNode' {   

        Action = 'InstallFailoverCluster';

        SuppressReboot = $true;
        ForceReboot = $false;
        InstanceName = $ConfigData.allnodes.InstanceName;
        Features = $ConfigData.allnodes.Features;
        SourcePath = $ConfigData.allnodes.SourcePath;
        SQLSysAdminAccounts = $ConfigData.allnodes.SQLSysAdminAccounts;
        SecurityMode  = "SQL";
        SAPwd  = $SAAccount;
        UpdateEnabled = $true;

        InstallSharedDir =  "C:\Program Files\Microsoft SQL Server";
        InstallSharedWOWDir = "C:\Program Files (x86)\Microsoft SQL Server";
        InstanceDir = 'C:\Program Files\Microsoft SQL Server';

        SQLUserDBDir = "S:\DATA\";
        SQLUserDBLogDir = "E:\LOGS\";
        SQLTempDBDir = "T:\DATA\";
        SQLTempDBLogDir = "D:\LOGS\";
        SQLBackupDir = 'Z:\BACKUP\';

        FailoverClusterNetworkName = 'SQLCLUS01';
        FailoverClusterIPAddress   = '192.168.0.100';

johlju commented 5 years ago

Please provide the verbose logs as well, see my previous comment. Also, the configuration does not look complete, what credentials are you using to run the resource? Without credentials LCM is running the resource as NT AUTHORITY\SYSTEM, is that intended?

Have you looked at this? https://github.com/PowerShell/SqlServerDsc/tree/dev/Examples#setting-up-a-sql-server-failover-cluster

smareano commented 5 years ago

Hi, here is the verbose log:

VERBOSE: Performing the operation "Start-DscConfiguration: SendMetaConfigurationApply" on target "MSFT_DSCLocalConfigurationManager".
VERBOSE: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = SendMetaConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguratio
n'.
VERBOSE: An LCM method call arrived from computer SQLCLUS01 with user sid S-1-5-21-1951452723-2239084835-3638747796-5895.
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Set      ]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Resource ]  [MSFT_DSCMetaConfiguration]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Set      ]  [MSFT_DSCMetaConfiguration]
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Set      ]  [MSFT_DSCMetaConfiguration]  in 0.0300 seconds.
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Resource ]  [MSFT_DSCMetaConfiguration]
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Set      ]
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Set      ]    in  0.1460 seconds.
VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Set-DscLocalConfigurationManager finished in 0.334 seconds.
VERBOSE: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = SendConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: An LCM method call arrived from computer SQLCLUS01a with user sid S-1-5-21-1951452723-2239084835-3638747796-5895.
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Set      ]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Resource ]  [[WindowsFeature]NetFramework45]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Test     ]  [[WindowsFeature]NetFramework45]
VERBOSE: [SQLCLUS01a]:                            [[WindowsFeature]NetFramework45] The operation 'Get-WindowsFeature' started: NET-Framework-45-Core
VERBOSE: [SQLCLUS01a]:                            [[WindowsFeature]NetFramework45] The operation 'Get-WindowsFeature' succeeded: NET-Framework-45-Core
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Test     ]  [[WindowsFeature]NetFramework45]  in 0.8430 seconds.
VERBOSE: [SQLCLUS01a]: LCM:  [ Skip   Set      ]  [[WindowsFeature]NetFramework45]
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Resource ]  [[WindowsFeature]NetFramework45]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Resource ]  [[File]DataFolder]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Test     ]  [[File]DataFolder]
VERBOSE: [SQLCLUS01a]:                            [[File]DataFolder] The destination object was found and no action is required.
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Test     ]  [[File]DataFolder]  in 0.0210 seconds.
VERBOSE: [SQLCLUS01a]: LCM:  [ Skip   Set      ]  [[File]DataFolder]
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Resource ]  [[File]DataFolder]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Resource ]  [[File]LogFolder]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Test     ]  [[File]LogFolder]
VERBOSE: [SQLCLUS01a]:                            [[File]LogFolder] The destination object was found and no action is required.
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Test     ]  [[File]LogFolder]  in 0.0070 seconds.
VERBOSE: [SQLCLUS01a]: LCM:  [ Skip   Set      ]  [[File]LogFolder]
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Resource ]  [[File]LogFolder]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Resource ]  [[File]TempFolderData]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Test     ]  [[File]TempFolderData]
VERBOSE: [SQLCLUS01a]:                            [[File]TempFolderData] The destination object was found and no action is required.
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Test     ]  [[File]TempFolderData]  in 0.0070 seconds.
VERBOSE: [SQLCLUS01a]: LCM:  [ Skip   Set      ]  [[File]TempFolderData]
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Resource ]  [[File]TempFolderData]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Resource ]  [[File]BackupsFolder]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Test     ]  [[File]BackupsFolder]
VERBOSE: [SQLCLUS01a]:                            [[File]BackupsFolder] The destination object was found and no action is required.
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Test     ]  [[File]BackupsFolder]  in 0.0070 seconds.
VERBOSE: [SQLCLUS01a]: LCM:  [ Skip   Set      ]  [[File]BackupsFolder]
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Resource ]  [[File]BackupsFolder]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Resource ]  [[SqlSetup]InstallClusterFirstNode]
VERBOSE: [SQLCLUS01a]: LCM:  [ Start  Test     ]  [[SqlSetup]InstallClusterFirstNode]
VERBOSE: [SQLCLUS01a]: LCM:  [ End    Test     ]  [[SqlSetup]InstallClusterFirstNode]  in 0.1570 seconds.
Logon failure: the user has not been granted the requested logon type at this computer
    + CategoryInfo          : AuthenticationError: (:) [], CimException
    + FullyQualifiedErrorId : Win32Error:1385
    + PSComputerName        : localhost

VERBOSE: [SQLCLUS01a]: LCM:  [ End    Set      ]
The SendConfigurationApply function did not succeed.
    + CategoryInfo          : NotSpecified: (root/Microsoft/...gurationManager:String) [], CimException
    + FullyQualifiedErrorId : MI RESULT 1
    + PSComputerName        : localhost

VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Time taken for configuration job to complete is 2.953 seconds
================================================================

and here is the complete configuration:

Configuration SQLInstallCluster

{ 
    param(
        [PsCredential] $SetupCredential,
        [PsCredential] $SQLSvcAccount,
        [PsCredential] $AgtSvcAccount,
        [PsCredential] $SAAccount
        )

    Import-DscResource -ModuleName SqlServerdsc
    Import-DscResource –ModuleName 'PSDesiredStateConfiguration'

     node $AllNodes.nodename
     {  

        WindowsFeature 'NetFramework45' {
            Name = 'NET-Framework-45-Core'
            Ensure = 'Present'
        }

        File 'DataFolder' {
            DestinationPath = (Join-Path -Path S:\DATA\ -ChildPath $($Name))
            Ensure = "Present"
            Force = $True
            Type = "Directory"
        }

        File 'LogFolder' {
            DestinationPath = (Join-Path -Path E:\LOGS\ -ChildPath $($Name))
            Ensure = "Present"
            Force = $True
            Type = "Directory"
        }

        File 'TempFolderData' {
            DestinationPath = (Join-Path -Path T:\DATA\ -ChildPath $($Name))
            Ensure = "Present"
            Force = $True
            Type = "Directory"
        }

        File 'BackupsFolder' {
            DestinationPath = (Join-Path -Path Z:\BACKUP\ -ChildPath $($Name))
            Ensure = "Present"
            Force = $True
            Type = "Directory"
        }

        SQLSetup 'InstallClusterFirstNode' {   

            Action = 'InstallFailoverCluster';

            SuppressReboot = $true;
            ForceReboot = $false;
            InstanceName = $ConfigData.allnodes.InstanceName;
            Features = $ConfigData.allnodes.Features;
            SourcePath = $ConfigData.allnodes.SourcePath;
            SQLSysAdminAccounts = $ConfigData.allnodes.SQLSysAdminAccounts;
            SecurityMode  = "SQL";
            SAPwd  = $SAAccount;
            UpdateEnabled = $true;

            InstallSharedDir =  "C:\Program Files\Microsoft SQL Server";
            InstallSharedWOWDir = "C:\Program Files (x86)\Microsoft SQL Server";
            InstanceDir = 'C:\Program Files\Microsoft SQL Server';

            SQLUserDBDir = "S:\DATA\";
            SQLUserDBLogDir = "E:\LOGS\";
            SQLTempDBDir = "T:\DATA\";
            SQLTempDBLogDir = "E:\LOGS\";
            SQLBackupDir = 'Z:\BACKUP\';

            FailoverClusterNetworkName = 'SQLCLUS01';
            FailoverClusterIPAddress   = '192.168.0.100';

            SqlTempdbFileCount = $ConfigData.allnodes.TMPdbFiles;
            SqlTempdbFileGrowth = 0;
            SqlTempdbFileSize = $ConfigData.allnodes.TMPdbSize;

            SQLSvcAccount = $SQLSvcAccount;
            AgtSvcAccount = $AgtSvcAccount;
            #ISSvcAccount = $ISAccount;

            PsDscRunAsCredential =  $SetupCredential;

            DependsOn = @("[File]DataFolder","[File]LogFolder","[File]TempFolderData",`
            "[File]BackupsFolder","[WindowsFeature]NetFramework45")

           }

        SqlServerMemory 'SetMaxMem' {
            Ensure = 'Present';
            DynamicAlloc = $false;
            PsDscRunAsCredential = $SetupCredential;
            InstanceName = $ConfigData.allnodes.InstanceName;
            DependsOn = '[SQLSetup]InstallClusterFirstNode';
            MaxMemory = $ConfigData.allnodes.SQLMaxMemory;
        }

        LocalConfigurationManager {
            CertificateId = $ConfigData.allnodes.Thumbprint
            ConfigurationMode = "ApplyandAutoCorrect"
        }
     }
}

johlju commented 5 years ago

The issue is that the account you are using for PsDscRunAsCredential does not have enough privileges, see the article Use Credentials with DSC Resources.

The SeInteractiveLogonRight is required, by the target machine, for any account you specify to PsDscRunAsCredential.

smareano commented 5 years ago

Thanks a lot for the quick response and help. I put a request for the permission to be applied. I will update this thread once I run the DSC with the suggested permission.

Thank you!

johlju commented 5 years ago

No problem happy to help. 🙂

smareano commented 5 years ago

Hello again, Adding my domain user on log on locally...didn't help. I was able to use local admin account for installer. PS didn't throw log on issue at this time. But I am getting this on VERBOS. FYI: I am running the install with only one node cluster. The other node is not yet provided.

FailoverClusterIPAddress 'xxxx' is not in the desired state for this cluster. FailoverClusterNetworkName 'xxxx'' is not in the desired state for this cluster.

PowerShell DSC resource MSFT_SqlSetup failed to execute Set-TargetResource functionality with error message: System.Exception: Test-TargetResource function returned false when Set-TargetResource function verified the desired state. This indicates that the Set-TargetResource did not correctly set set the desired state, or that the function Test-TargetResource does not correctly evaluates the desired state.

CategoryInfo : InvalidOperation: (:) [], CimException
FullyQualifiedErrorId : ProviderOperationExecutionFailure
PSComputerName : Localhost

johlju commented 5 years ago

Adding my domain user on log on locally.

Should be interactive logon, not log on locally (although that might be needed also).

FailoverClusterIPAddress 'xxxx' is not in the desired state for this cluster. FailoverClusterNetworkName 'xxxx'' is not in the desired state for this cluster.

Maybe you are seeing the same problem as this comment https://github.com/PowerShell/SqlServerDsc/issues/1423#issuecomment-523915367. Please open a new issue describing the problem you are seeing now, together with the configuration and verbose logs etc. See issue template for a problem with a resource.

Closing this issue as the initial question was solved.

craig-martin commented 4 years ago

Broken link above, here's the updated link: Use Credentials with DSC Resources

dsccommunity / SqlServerDsc

Logon failure: the user has not been granted the requested logon type at this computer #1416