# DSC to join domain

**URL:** <https://forums.powershell.org/t/dsc-to-join-domain/8820>\
**Category:** DSC\
**Created:** [June 13, 2017, 5:45am UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820 "2017-06-13T05:45:15Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![jensv](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@jensv](https://forums.powershell.org/u/jensv)\
**Post date:** [June 13, 2017, 5:45am UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820/1 "2017-06-13T05:45:15Z")

</div>

Hello all,

I’m experiencing with some DSC scripts in azure.

> Login-AzureRmAccount
> 
> Show-SubscriptionARM
> 
> $rgName = ‘rgName’  
> $storageAccountName = “storageaccount”
> 
> $storageAccount = Get-AzureRmStorageAccount -ResourceGroupName $rgName -AccountName $storageAccountName  
> $storageAccountKey = (Get-AzureRmStorageAccountKey -ResourceGroupName $rgName -AccountName $storageAccountName).Value[0]
> 
> # we are using default container
> 
> $containerName = ‘windows-powershell-dsc’
> 
> $configurationName = ‘IISInstall’  
> $configurationPath = “.$configurationName.ps1”  
> #Publish your DSC configuration to the Azure storage  
> $moduleURL = Publish-AzureRmVMDscConfiguration -ConfigurationPath $configurationPath -ResourceGroupName $rgName -StorageAccountName $storageAccount.StorageAccountName -Force
> 
> $storageContext = New-AzureStorageContext -StorageAccountName $storageAccount.StorageAccountName -StorageAccountKey $storageAccountKey  
> $sasToken = New-AzureStorageContainerSASToken -Name $containerName -Context $storageContext -Permission r
> 
> $settingsHashTable = @{  
> “ModulesUrl” = “$moduleURL”;  
> “ConfigurationFunction” = “$configurationName.ps1$configurationName”;  
> “SasToken” = “$sasToken”  
> }
> 
> $vmName= “VMTEST”  
> $extensionName = ‘DSC’  
> $extensionType = ‘DSC’  
> $publisher = ‘Microsoft.Powershell’  
> $typeHandlerVersion = ‘2.1’
> 
> Set-AzureRmVMExtension -ResourceGroupName $rgName -VMName $vmName -Location $storageAccount.Location `  
> -Name $extensionName -Publisher $publisher -ExtensionType $extensionType -TypeHandlerVersion $typeHandlerVersion `  
> -Settings $settingsHashTable

This script calls the DSC what is in these script:

> Configuration IISInstall {
> 
> ```
> Import-DSCResource -module xDSCDomainjoin
> #domain credentials to be given here   
> $secdomainpasswd = ConvertTo-SecureString "password" -AsPlainText -Force
> $mydomaincreds = New-Object System.Management.Automation.PSCredential("domain\account", $secdomainpasswd)
> $domain = "mydomain"
> 
> Node localhost
> 
> ```
> 
> {  
> WindowsFeature IIS  
> {  
> Name = “Web-Server”  
> Ensure = “Present”  
> }
> 
> ```
> # Install ASP.NET 4.5 
> WindowsFeature AspNet45  
> 
> {
> Name = "Web-Asp-Net45" 
> Ensure = "Present"
> }
> 
> # Join domain
> xDSCDomainjoin JoinDomain
> {
> Domain = $domain
> Credential = $mydomaincreds          
> }
> }
> 
> ```
> 
> }

The first 2 steps are successful, however the domain join function always gives an error. Anyone knows what is the problem?

I would like to join the domain with the DSC script.

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [June 13, 2017, 8:07am UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820/2 "2017-06-13T08:07:24Z")

</div>

It’s a little tough to guess what the error might be. Can you just post the error?

---

<div class="post-metadata">

**Author:** ![jensv](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@jensv](https://forums.powershell.org/u/jensv)\
**Post date:** [June 14, 2017, 1:38am UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820/3 "2017-06-14T01:38:30Z")

</div>

Sorry about that. Here is the error:

Set-AzureRmVMExtension : Long running operation failed with status ‘Failed’.  
ErrorCode: VMExtensionProvisioningError  
ErrorMessage: VM has reported a failure when processing extension ‘DSC’. Error message: "The DSC Extension received an incorrect input: Compilation errors occurred while processing configuration ‘IISInsta  
ll’. Please review the errors reported in error stream and modify your configuration code appropriately. System.InvalidOperationException error processing property ‘Credential’ OF TYPE ‘xDSCDomainjoin’: C  
onverting and storing encrypted passwords as plain text is not recommended. For more information on securing credentials in MOF file, please refer to MSDN blog: [Bing](http://go.microsoft.com/fwlink/?LinkId=3937)  
29  
At C:\Packages\Plugins\Microsoft.Powershell.DSC\2.26.0.0\DSCWork\IISInstall.ps1.0\IISInstall.ps1:75 char:5

- xDSCDomainjoin Converting and storing encrypted passwords as plain text is not recommended. For more information on securing credentials in MOF file, please refer to MSDN blog: [http://go.microsoft.com](http://go.microsoft.com)  
/fwlink/?LinkId=393729 Cannot find path ‘HKLM:\SOFTWARE\Microsoft\PowerShell\3\DSC’ because it does not exist. Cannot find path ‘HKLM:\SOFTWARE\Microsoft\PowerShell\3\DSC’ because it does not exist.  
Another common error is to specify parameters of type PSCredential without an explicit type. Please be sure to use a typed parameter in DSC Configuration, for example:  
configuration Example {  
param([PSCredential] $UserAccount)  
…  
}.  
Please correct the input and retry executing the extension.".  
StartTime: 14/06/2017 8:59:39  
EndTime: 14/06/2017 9:06:57  
OperationID: 10c08c2e-de25-439d-b02a-d9646dcd477b  
Status: Failed  
At line:31 char:1
- Set-AzureRmVMExtension -ResourceGroupName $rgName -VMName $vmName -Location $st …
- 

```auto
  + CategoryInfo : CloseError: (:) [Set-AzureRmVMExtension], ComputeCloudException
  + FullyQualifiedErrorId : Microsoft.Azure.Commands.Compute.SetAzureVMExtensionCommand
```

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [June 14, 2017, 6:58am UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820/4 "2017-06-14T06:58:44Z")

</div>

You appear to be trying to use a non-encrypted credential. That isn’t allowed - as described at the URL referenced in the error.

---

<div class="post-metadata">

**Author:** ![jensv](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@jensv](https://forums.powershell.org/u/jensv)\
**Post date:** [June 26, 2017, 3:40am UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820/5 "2017-06-26T03:40:18Z")

</div>

I added following in the first script:  
$settingsHashTable = @{  
“ModulesUrl” = “$moduleURL”;  
“ConfigurationFunction” = “$configurationName.ps1$configurationName”;  
“SasToken” = “$sasToken”  
AllNodes = @(  
@{  
NodeName = “localhost”  
PsDscAllowPlainTextPassword = $true  
}  
)  
}

So plain text password shouldn’t be a problem.  
However I still get the error. Any ideas how I can solve it?

Thanks.

---

<div class="post-metadata">

**Author:** ![jensv](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@jensv](https://forums.powershell.org/u/jensv)\
**Post date:** [June 28, 2017, 7:18am UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820/6 "2017-06-28T07:18:40Z")

</div>

I thought it maybe because the hash in a hash function, so I edited it to:  
$settingsHashTable = @{

```
        "ModulesUrl" = "$moduleURL";
        "ConfigurationFunction" = "$configurationName.ps1\$configurationName";
        "SasToken" = "$sasToken";
        "NodeName" = "localhost";
        "PsDscAllowPlainTextPassword" = $true
    }

```

But still an error…  
Set-AzureRmVMExtension : Long running operation failed with status ‘Failed’.  
ErrorCode: VMExtensionProvisioningError  
ErrorMessage: VM has reported a failure when processing extension ‘DSC’. Error message: "The DSC Extension received an incorrect input: Compilation errors occurred while processi  
ng configuration ‘IISInstall’. Please review the errors reported in error stream and modify your configuration code appropriately. System.InvalidOperationException error processi  
ng property ‘Credential’ OF TYPE ‘xDSCDomainjoin’: Converting and storing encrypted passwords as plain text is not recommended. For more information on securing credentials in MO  
F file, please refer to MSDN blog: [http://go.microsoft.com/fwlink/?LinkId=393729](http://go.microsoft.com/fwlink/?LinkId=393729)  
At C:\Packages\Plugins\Microsoft.Powershell.DSC\2.26.0.0\DSCWork\IISInstall.ps1.0\IISInstall.ps1:76 char:5

- xDSCDomainjoin Converting and storing encrypted passwords as plain text is not recommended. For more information on securing credentials in MOF file, please refer to MSDN blo  
g: [http://go.microsoft.com/fwlink/?LinkId=393729](http://go.microsoft.com/fwlink/?LinkId=393729) Cannot find path ‘HKLM:\SOFTWARE\Microsoft\PowerShell\3\DSC’ because it does not exist. Cannot find path ‘HKLM:\SOFTWARE\Microsof  
t\PowerShell\3\DSC’ because it does not exist.  
Another common error is to specify parameters of type PSCredential without an explicit type. Please be sure to use a typed parameter in DSC Configuration, for example:  
configuration Example {  
param([PSCredential] $UserAccount)  
…  
}.  
Please correct the input and retry executing the extension.".  
StartTime: 28/06/2017 14:39:24  
EndTime: 28/06/2017 14:45:58  
OperationID: edb84240-384f-4c83-8966-781339e75d65  
Status: Failed  
At line:48 char:1
- Set-AzureRmVMExtension -ResourceGroupName $rgName -VMName $vmName -Location $st …
- 

```auto
  + CategoryInfo : CloseError: (:) [Set-AzureRmVMExtension], ComputeCloudException
  + FullyQualifiedErrorId : Microsoft.Azure.Commands.Compute.SetAzureVMExtensionCommand
```

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [June 28, 2017, 7:20am UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820/7 "2017-06-28T07:20:58Z")

</div>

Keep in mind that Azure is a little different. The error is still telling me it doesn’t like your plain-text password. Azure’s DSC extension may simply - and wisely - disallow that.

---

<div class="post-metadata">

**Author:** ![michael-greene](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/michael-greene/32/337_2.png) [@michael-greene](https://forums.powershell.org/u/michael-greene)\
**Post date:** [June 28, 2017, 9:31am UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820/8 "2017-06-28T09:31:12Z")

</div>

Hi Jens, I’m a PM on Azure Automation DSC. Take a look at this doc on securing credentials used with the extension.  
[https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensions-dsc-credentials](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensions-dsc-credentials)

Overall, I typically recommend using the extension as a bootstrap mechanism in ARM templates and using the service for the actual configuration delivery wherever possible. It is night and day easier to diagnose problems when they occur, and you can understand the state of the machine over time rather than just at deployment.

Since your configuration contains a secret (credential) there are some gotchas along the way with both options. If you would like to PM me I’d be happy to help.

For more information:  
[https://docs.microsoft.com/en-us/azure/automation/automation-dsc-overview](https://docs.microsoft.com/en-us/azure/automation/automation-dsc-overview)

---

<div class="post-metadata">

**Author:** ![jensv](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@jensv](https://forums.powershell.org/u/jensv)\
**Post date:** [September 5, 2017, 1:59am UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820/9 "2017-09-05T01:59:20Z")

</div>

Hi Michael,

I’m again trying to set it up with azure automation, but again running into some trouble…

How can I contact you with a PM?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 9:16pm UTC](https://forums.powershell.org/t/dsc-to-join-domain/8820/10 "2024-05-16T21:16:40Z")

</div>

Closed on May 16, 2024, 9:16pm UTC