Take a look at the following configuration:
$configurationData =
@{
AllNodes =
@(
@{
NodeName = 'S16-01'
PsDscAllowPlainTextPassword = $true
PSDscAllowDomainUser = $true
}
)
}

Configuration DSCRunDemo
{
param (
[pscredential] $Credential
)
Import-DscResource -ModuleName PSDesiredStateConfiguration

Node $AllNodes.NodeName
{
Script DSCRunDemo1
{
SetScript =
{
Write-Verbose -Message $(whoami)
}
TestScript =
{
return $false
}
GetScript =
{
return @{}
}
PsDscRunAsCredential = $Credential
}

Script DSCRunDemo2
{
SetScript =
{
Write-Verbose -Message $(whoami)
}
TestScript =
{
return $false
}
GetScript =
{
return @{}
}
}
}
}

DSCRunDemo -ConfigurationData $configurationData -Credential (Get-Credential)

One instance of the script resource has PSDscRunAsCredential while the other does not. This compiles fine and then MOF looks good.

/*
@TargetNode='S16-01'
@GeneratedBy=Administrator
@GenerationDate=08/22/2017 13:36:38
@GenerationHost=S16-JB
*/

instance of MSFT_Credential as $MSFT_Credential1ref
{
Password = "Dell1234";
UserName = "psdsc\\administrator";

};

instance of MSFT_ScriptResource as $MSFT_ScriptResource1ref
{
ResourceID = "[Script]DSCRunDemo1";
PsDscRunAsCredential = $MSFT_Credential1ref;
GetScript = "\n return @{}\n ";
TestScript = " \n return $false\n ";
SourceInfo = "::22::9::Script";
SetScript = " \n Write-Verbose -Message $(whoami)\n ";
ModuleName = "PSDesiredStateConfiguration";

ModuleVersion = "0.0";

ConfigurationName = "DSCRunDemo";

};
instance of MSFT_ScriptResource as $MSFT_ScriptResource2ref
{
ResourceID = "[Script]DSCRunDemo2";
GetScript = "\n return @{}\n ";
TestScript = " \n return $false\n ";
SourceInfo = "::39::9::Script";
SetScript = " \n Write-Verbose -Message $(whoami)\n ";
ModuleName = "PSDesiredStateConfiguration";

ModuleVersion = "0.0";

ConfigurationName = "DSCRunDemo";

};
instance of OMI_ConfigurationDocument

{
Version="2.0.0";

MinimumCompatibleVersion = "2.0.0";

CompatibleVersionAdditionalProperties= {"Omi_BaseResource:ConfigurationName"};

Author="Administrator";

GenerationDate="08/22/2017 13:36:38";

GenerationHost="S16-JB";

Name="DSCRunDemo";

};

However, when we enact this configuration, it fails with the following message:

PS C:\> Start-DscConfiguration -Path .\DSCRunDemo -Verbose -Wait -Force
VERBOSE: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = SendConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: An LCM method call arrived from computer S16-JB with user sid S-1-5-21-689661094-3032901192-2251061677-500.
VERBOSE: [S16-01]: LCM: [ Start Set ]
VERBOSE: [S16-01]: LCM: [ End Set ]
The resources ('[Script]DSCRunDemo1' and '[Script]DSCRunDemo2') have conflicting values of the following properties: 'PsDscRunAsCredential'. Ensure that their values match.
+ CategoryInfo : ResourceExists: (root/Microsoft/...gurationManager:String) [], CimException
+ FullyQualifiedErrorId : MI RESULT 11
+ PSComputerName : S16-01

VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Time taken for configuration job to complete is 3.761 seconds

If this is by design, it is a wrong design. Think of adding registry configuration for multiple users on the same system using the same configuration document.

Votes from Connect: 17

Original Date Submitted: 8/13/2015 12:17:49 AM

Description:
********Contact Information********
Handle: PowerShellDon
Site Name: PowerShell
Feedback ID: 1659904
***************************************

Problem Description:
Suggestion one:

Add maintenance window awareness to the Local Configuration Manager. Edited via metaconfig, it specifies times when configuration changes are acceptable, when automated reboots are acceptable. Further automates configuration maintenance especially when you're implementing changes vs. correcting drift.

Suggestion two:

Add universal "DoNotImplementBefore" and "ImplementBy" settings to DSC resources. Just as "Present=" specifies to add/remove something, these would indicate a date/time for the setting to become valid (e.g., "we want to implement a bunch of changes, but not before x date") and a deadline by which the setting just be implemented (e.g., "this has to happen by x date"). The latter might play into the LCM configuration: For example, when set to ApplyAndAutoCorrect, even if AutoReboot=$false, an auto reboot may occur once a setting passes its "ImplementBy" date/time without previously being implemented.

These suggestions reflect some of the realities of managing a production environment.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1659904 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1659904).

Repro Steps:

Internal BugId: 15730

PS C:\Windows\system32> Get-PSRepository

Name InstallationPolicy SourceLocation
---- ------------------ --------------
PSGallery Untrusted https://www.powershellgallery.com/api/v2/
TestRepo Trusted \\NugetServer\BMNNuGet\packages

PS C:\Windows\system32> Find-Module * -Repository TestRepo

Version Name Repository Description
------- ---- ---------- -----------
1.0.1 cConfigNode TestRepo Provides a way to manipulate nodes of the xml configu...
1.3.0 cNtfsAccessControl TestRepo The cNtfsAccessControl module contains DSC resources ...
3.2.0 xNetworking TestRepo Module with DSC Resources for Networking area
1.0.0 xReleaseManagement TestRepo Host a custom DSC Resource to transform files based o...
1.17.0 xWebAdministration TestRepo Module with DSC Resources for Web Administration

PS C:\Windows\system32> Find-Module xNetworking -Repository TestRepo
PackageManagement\Find-Package : No match was found for the specified search criteria and module name 'xNetworking'. Try
Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1360 char:3
+ PackageManagement\Find-Package @PSBoundParameters | Microsoft ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Microsoft.Power...ets.FindPackage:FindPackage) [Find-Package], Exception
+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.FindPackage

PS C:\Windows\system32> Install-Module xNetworking -Repository TestRepo
PackageManagement\Install-Package : No match was found for the specified search criteria and module name 'xNetworking'. Try
Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1772 char:21
+ ... $null = PackageManagement\Install-Package @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Excepti
on
+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

PS C:\Windows\system32> $Credential

PS C:\Windows\system32> Find-Module xNetworking -Repository TestRepo -Credential (Get-Credential)
cmdlet Get-Credential at command pipeline position 1
Supply values for the following parameters:
PackageManagement\Find-Package : No match was found for the specified search criteria and module name 'xNetworking'. Try
Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1360 char:3
+ PackageManagement\Find-Package @PSBoundParameters | Microsoft ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Microsoft.Power...ets.FindPackage:FindPackage) [Find-Package], Exception
+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.FindPackage

PS C:\Windows\system32> Find-Module * -Repository TestRepo | Install-Module
PackageManagement\Install-Package : No match was found for the specified search criteria and module name 'xNetworking'. Try
Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1875 char:34
+ ... $null = PackageManagement\Install-Package @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Excepti
on
+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

PackageManagement\Install-Package : No match was found for the specified search criteria and module name
'xReleaseManagement'. Try Get-PSRepository to see all available registered module repositories.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1875 char:34
+ ... $null = PackageManagement\Install-Package @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Excepti
on
+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

Votes from Connect: 5

Original Date Submitted: 2/20/2015 2:01:32 PM

Description:

********Contact Information********
Handle: john.s2011n
Site Name: PowerShell
Feedback ID: 1139497
***************************************

Frequency: Always Happens
Regression: Yes, this happens in all previous versions

Problem Description:
in PS 4.0 and also previous versions, there is no option to easily convert multiple selected lines to comment block. so when we have selected multiple lines & we want to make them as comment, we have to insert comment block in another location on the pane, and then cut these multiple lines and paste them inside comment block which is a bit cumbersome.
but in other products like VBA2013, this option exist & there is a button on edit toolbar which converts multiple lines into comment, in place.

hope this be added in PS 5.0
thanks

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1139497 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1139497).

Repro Steps:
Expected Results:

Internal BugId: 13253

NuGet feeds allow security around both listing/retrieving packages as well as pushing packages. NuGet.exe and other clients further allow you to persist credentials for listing/retrieving packages using the "nuget sources" command. (https://docs.nuget.org/consume/command-line-reference#sources-command)

This persistence is important for two reasons:

1) When you push a package to a secured NuGet feed, NuGet clients generally do a list/read operation first. That list/read operation doesn't contain any API key that you pass along in the push operation. In order for a push to succeed with an API key, you also need to have credentials set for the read operation. You can read about some folks who have been affected by that here: http://inedo.com/support/questions/2319

2) In an unattended/build server scenario, you need the ability to provide credentials for list/read and push in a non-interactive way. If the only way to provide credentials is interactive (e.g., Get-Credential) then there's no way to, say, enable a build server agent to automatically install required scripts to execute a build.

This may somewhat overlap with this other note about Register-PSRepository failing against authenticated endpoints: http://windowsserver.uservoice.com/forums/301869-powershell/suggestions/11678499-register-psrepository-fails-against-authenticated

Steps to reproduce:

1. Install WMF5 RTM on a fresh Windows 2012 R2 system
2. Open an Administrator PS prompt and run "Install-Module Pester -Force"

Expected result: The -Force parameter causes the NuGet client to be installed without user intervention.

Actual result: The following message is displayed:

NuGet-anycpu.exe is required to continue.
PowerShellGet requires NuGet-anycpu.exe to interact with NuGet based galleries. NuGet-anycpu.exe must be available in
'C:\Program Files\PackageManagement\ProviderAssemblies' or
'C:\Users\Administrator\AppData\Local\PackageManagement\ProviderAssemblies'. For more information about NuGet provider,
see http://OneGet.org/NuGet.html. Do you want PowerShellGet to download NuGet-anycpu.exe now?
[Y] Yes [N] No [S] Suspend [?] Help (default is "Y"):

The MSDN documentation for $PSCmdlet.ShouldContinue (https://msdn.microsoft.com/en-us/library/ms568259%28v=vs.85%29.aspx) states "Cmdlets calling ShouldContinue should also implement a Force parameter that allows the cmdlet to bypass these calls. If this is not done, it will be difficult to use the cmdlet from scripts and noninteractive hosts." I'm trying to use Install-Module from an automated setup script on a fresh machine, and this prompt causes the script to hang.

Workaround: Before using Install-Module for the first time, run the following command to fetch NuGet-anycpu.exe (this is what Install-Module is doing internally):

PackageManagement\Get-PackageProvider -Name NuGet -Force

I think it's time for an overhaul of Group Policy and GP Preferences. You can still keep the GUI to allow everyone to have something familiar, but I would love to see if Group Policy can be converted to start using PowerShell DSC under the hood. I think this would make things much simpler in terms of deployment and wouldn't require logon/logoff or restarts anymore (unless you wanted a script to run at those times). For everything else like IE/Edge settings, registry settings, mapped drives/printers, desktop backgrounds and such I think having everything exposed in PowerShell would both make it more secure (as we've recently seen with the SMB signing problems) and easier to troubleshoot. It might even make it easier to deploy a Linux version of Group Policy since DSC can work against Linux...

OS: Windows Server 2016 1607 (14393.1593)
PSVersionTable:
Name Value
---- -----
PSVersion 5.1.14393.1532
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.1532
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

PSDscResource module: v2.8.0.0

Take a look at this configuration:
Configuration DependentConfig
{
Import-DscResource -ModuleName PSDscResources -Name Registry

Node MyNode01
{

File SetupScript
{
DestinationPath = 'C:\Scripts\hello.txt'
Contents = 'somecommand'
Type = 'File'
Ensure = 'Present'
DependsOn = '[Registry]regCheck'
}

Registry regCheck
{
Key = 'HKEY_LOCAL_MACHINE\SYSTEM\SomeKey'
ValueName = 'SomeValue'
ValueData = 0
ValueType = 'DWord'
Ensure = 'Present'
}
}
}

DependentConfig -OutputPath C:\DependentConfig

This requires PSDscResources module version 2.8.0.0 from the gallery and the file resource from the PSDesiredStateConfiguration in-box module. However, compiling this configuration will fail with a message that File resource cannot be loaded. If we remove -Name File from the first import command, you will see an error that Registry resource cannot be found. We have to use -Name with PSDscResources since PSDesiredStateConfiguration already exports the same resource.

So, the only work around at this time is to remove the PSDesiredStateConfiguration import completely from the configuration so that we can at least compile this. Here is something that works.

Configuration DependentConfig
{
Import-DscResource -ModuleName PSDesiredStateConfiguration
Import-DscResource -ModuleName PSDscResources -Name Registry

Node MyNode01
{

File SetupScript
{
DestinationPath = 'C:\Scripts\hello.txt'
Contents = 'somecommand'
Type = 'File'
Ensure = 'Present'
DependsOn = '[Registry]regCheck'
}

Registry regCheck
{
Key = 'HKEY_LOCAL_MACHINE\SYSTEM\SomeKey'
ValueName = 'SomeValue'
ValueData = 0
ValueType = 'DWord'
Ensure = 'Present'
}
}
}

DependentConfig -OutputPath C:\DependentConfig

When upgrading to WMF 5.1, we are seeing errors in the DSC event log on servers that use a configuration with encrypted content (passwords). We are using encrypted credentials to create application pools and assign a service account as the identity. The data gets decrypted fine and the app pools get created with the correct identities. However the following error gets logged in the DSC event log every time a consistency check runs:

Job :
Message Cannot unprotect message. The input contained no encrypted content. Specify the '-IncludeContext' parameter if you wish to output the original content when no encrypted content is detected.
HResult -2146233087
StackTrack at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
at Microsoft.PowerShell.DesiredStateConfiguration.Internal.ResourceProviderAdapter.CMS_DecryptMessage(String thumbprint, String encryptedMessage, IStreamsHandler plugInStreamsHandler, String& outputResult, IntPtr& errorInstanceHandle)

We updated our certificate to use the new requirements for WMF 5.1 and everything looks fine there.

I ran into this one, after I noticed my newly patched workstation was still turned on in the morning even though I had explicitly requested it to shutdown at a certain time. Basically the repro steps are as follows:

> Open Non-Administrative Shell
> Stop-Computer
Output:
stop-computer : Privilege not held.
At line:1 char:1
+ stop-computer
+ ~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (***:String) [Stop-Computer], ManagementException
+ FullyQualifiedErrorId : StopComputerException,Microsoft.PowerShell.Commands.StopComputerCommand

Administrative shell works as expected, this specific workstation has never participated in any fast/slow ring builds. Windows version is 15063.138

Another Windows 10 system, fast ring, that is on build 15063.14 does not exhibit this behavior. Starting PowerShell -version 2 and then running Stop-Computer still works, as does running it from administrative shell.

Full log is available below:

Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\Users\Jaap Brasser> stop-computer
stop-computer : Privilege not held.
At line:1 char:1
+ stop-computer
+ ~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (***:String) [Stop-Computer], ManagementException
+ FullyQualifiedErrorId : StopComputerException,Microsoft.PowerShell.Commands.StopComputerCommand

PS C:\Users\Jaap Brasser> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ==================================== ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Users\Jaap Brasser> $psversiontable

Name Value
---- -----
PSVersion 5.1.15063.138
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.15063.138
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

PS C:\Users\Jaap Brasser> powershell -version 2
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.

PS C:\Users\Jaap Brasser> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ==================================== ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Users\Jaap Brasser>

On 2 Fully Updated Windows Server 2016 Machines running and provisioned from Azure I have created a Pull Server Configuration. I have created the DSC Signing Certificate using a custom template on a Enterprise Root CA which has worked for 2012R2 nodes and also tested using xDSCUtils New-xSelfSignedDscEncryptionCertificate. Using the same Certificate to Compile and Execute the MOF on the same Computer works, it is only if you compile on one and execute on another that the problems arise.
I kept getting errors when passing in credentials. I therefore wrote a tiny custom DSC Resource that Displays the Password as clear text when I run Start-DSCConfiguration -Wait -Verbose
You can find it here https://gist.github.com/aboersch/65e846a4966fe2c4708ed21d655a54a7
The Client does not correctly decrypt the Credentials. As a Password I am receiving
-----BEGIN CMS-----
<Long Multi-Line Base64 String>
-----END CMS-----
If I pass this to Unprotect-CmsMessage I receive the correct Password.
The Certificate passes $_.PrivateKey.KeyExchangeAlgorithm and $_.Verify
I have tried changing the Certificate Provider to '"Microsoft Enhanced Cryptographic Provider v1.0"', '"Legacy Cryptographic Service Provider"', and '"Microsoft RSA SChannel Cryptographic Provider"'.
I have already tried these:
http://stackoverflow.com/questions/34006865/dsc-problems-with-credentials-and-build-10586
https://wespoint.wordpress.com/2017/01/19/powershell-dsc-encryption-issue/

Hi all,
I am using DSC partials to create role-based architectures with Azure virtual machines.
When switching to Windows 2016 (everything works great on Windows 2012 R2), I get errors when DSC is compiling the MOF.
The idea is that I have multiple partials that contain the same Windows Feature installation, because it's needed for a certain roles. When I apply more roles on the same machine, the partials need to merge. So I have one partial that contains this:
WindowsFeature DotNetFrameworkRole1
{
Name = 'AS-NET-Framework'
}
and another partial that contains this:
WindowsFeature DotNetFrameworkRole2
{
Name = 'AS-NET-Framework'
}
When applying the partials on same machine (again, works fine in Windows 2012), I get these errors on Windows 2016:

Job {B1BD89DA-1965-11E7-A942-000D3A27FE28} :
MIResult: 11
Error Message: The resources ('[WindowsFeature]DotNetFrameworkRole1' and '[WindowsFeature]DotNetFrameworkRole2') have conflicting values of the following properties: 'ModuleVersion'. Ensure that their values match. Merging of partial configurations failed. LCM failed to start desired state configuration manually.
Message ID: MI RESULT 11
Error Category: 20
Error Code: 11
Error Type: MI

Job {3CFCAF9F-1967-11E7-A942-000D3A27FE28} :
MIResult: 11
Error Message: The resources ('[WindowsFeature]DotNetFrameworkRole1' and '[WindowsFeature]DotNetFrameworkRole2') have conflicting values of the following properties: 'ModuleVersion'. Ensure that their values match. Merging of partial configurations failed.
Message ID: MI RESULT 11
Error Category: 20
Error Code: 11
Error Type: MI

Any ideas for this one?
Thank you,
Sorin