Add-ADGroupMember “MemberTimeToLive” parameter recognised after enabling ActiveDirectory Privileged Access Management Feature
I’ve recently discovered the MemberTimeToLive that comes with the “Privileged Access Management Feature” in Windows Server 2016 forest functional level. (I of course immediately wanted it!)
So I had ran through the steps required to enable the feature – something like https://4sysops.com/archives/privileged-access-management-assign-temporary-ad-group-membership. That worked without issue. But when testing the Add-ADGroupMember returned "A parameter cannot be found that matches parameter name ‘MemberTimeToLive’.
Through the AD feature is not enabled on another domain’s server, I can type the Add-ADGroupMember command then the parameter tab-completes! But still doesn’t run, so thought there might be a difference in the module that I can use.
What I’ve tried
- Reimporting the module with '-Force'
- Moving a copy of DLL-based ActiveDirectory module directory from where it worked to where it didn't (checked that that was the one being pointed to in the first place)
- Again reimporting
- What I've tried to try
- I'm not able to explore the DLL-based module unless I decompiled it! Or is there another way to delve deeper on DLL-based modules. (Not that there's a great need usually.)
PS C:\Users.fnicules> Get-Help Add-ADGroupMember -Parameter MemberTimeToLive
Get-Help : No parameter matches criteria MemberTimeToLive.
At line:1 char:1
PS C:\Users.fnicules> Get-Command Add-ADGroupMember -Syntax
Add-ADGroupMember [-Identity] <ADGroup> [-Members] <ADPrincipal> [-WhatIf] [-Confirm] [-AuthType <ADAuthType>] [-Crede
ntial <pscredential>] [-Partition <string>] [-PassThru] [-Server <string>] [<CommonParameters>]
So no MemberTimeToLive parameter!
Does anyone know what I’m doing wrong, or what I can look please?