# Group Resource encrypted credentials issue

**URL:** <https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542>\
**Category:** DSC\
**Created:** [May 6, 2014, 4:05am UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542 "2014-05-06T04:05:38Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![geathan](https://avatars.discourse-cdn.com/v4/letter/g/b9e5f3/32.png) [@geathan](https://forums.powershell.org/u/geathan)\
**Post date:** [May 6, 2014, 4:05am UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542/1 "2014-05-06T04:05:38Z")

</div>

Im having issues with the Group Resource and domain user accounts. It seems to only work if i use the PSDscAllowPlainTextPassword=$true variable when passing in the credentials. If i use the CertificateFile variable in the configuration data pointed to a cert that’s installed on the target node i get the error below. Has anyone gotten the Group Resource to work with encrypted credentials?

The PowerShell provider MSFT\_GroupResource threw one or more non-terminating errors while running the Test-TargetResource functionality. These errors are logged to the ETW channel called Microsoft-Windows-DSC/Operational.  
Refer to this channel for more details.  
+ CategoryInfo : InvalidOperation: (🙂 , CimException  
+ FullyQualifiedErrorId : NonTerminatingErrorFromProvider  
+ PSComputerName : localhost

EventLog:

Job {DF4B4371-F349-440A-A50C-C57FFE37E6C3} :  
This event indicates that a non-terminating error was thrown when DSCEngine was executing Test-TargetResource on MSFT\_GroupResource provider. FullyQualifiedErrorId is COMException. ErrorMessage is Exception calling “FindByIdentity” with “2” argument(s): "The user name or password is incorrect.  
".

```
$ConfigurationData=@{

AllNodes = @(
 
   # All the Servers have the following identical information
       @{
            NodeName = "*"
            CertificateFile = "c:\cert.cer"            
       },

       @{
            NodeName = "localhost"
        }     
    );

}

configuration AdminGroup
{
param(
    [PsCredential]$Credential
)
    node $Allnodes.NodeName
        {
            Group Administrators
            {
                GroupName = "Administrators"
                Credential = $Credential 
                Ensure = "Present"
                Members = "Administrator","Lab\account1","lab\account2"
            }
        }
}

AdminGroup -ConfigurationData $ConfigurationData -OutputPath c:\AdminGroup -Credential (Get-Credential)

Start-DscConfiguration -Path C:\AdminGroup -Wait -Verbose -force -WhatIf
```

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [May 6, 2014, 4:16am UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542/2 "2014-05-06T04:16:20Z")

</div>

Almost looks like a bug in the resource. Do we have a version of that in the community repo?

---

<div class="post-metadata">

**Author:** ![geathan](https://avatars.discourse-cdn.com/v4/letter/g/b9e5f3/32.png) [@geathan](https://forums.powershell.org/u/geathan)\
**Post date:** [May 6, 2014, 4:49am UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542/3 "2014-05-06T04:49:36Z")

</div>

I was unable to find a comparable one in the repo.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/powershell/original/1X/385e4f9fe133561ad30a814262fe0e0ae6bc3ef0.png) [@system](https://forums.powershell.org/u/system)\
**Post date:** [May 6, 2014, 4:52am UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542/4 "2014-05-06T04:52:27Z")

</div>

I haven’t tested this functionality yet myself, but looking at this [PowerShell blog post](http://blogs.msdn.com/b/powershell/archive/2014/01/31/want-to-secure-credentials-in-windows-powershell-desired-state-configuration.aspx), they have some extra bits that are missing from your configuration. (Specifically, the thumbprint in configurationData, the LocalConfigurationManager resource setting CertificateId to that thumbprint, and the call to Set-DscLocalConfigurationManager on the target node to configure the LCM using those options. The certificate must also be installed, with its private key, on the target node(s).)

Have you already performed these steps, separately from what you’ve posted here?

---

<div class="post-metadata">

**Author:** ![geathan](https://avatars.discourse-cdn.com/v4/letter/g/b9e5f3/32.png) [@geathan](https://forums.powershell.org/u/geathan)\
**Post date:** [May 6, 2014, 6:21am UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542/5 "2014-05-06T06:21:47Z")

</div>

Ah silly me, i feel like an idiot. I’m trying to do a quick test using push and i forgot all about the LCM CertificateId. That’s exactly what the issue was

Thanks DAVE!

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [May 6, 2014, 7:17am UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542/6 "2014-05-06T07:17:08Z")

</div>

Do a favor and bug that in [Connect.Microsoft.com](http://Connect.Microsoft.com) anyway. The resource should provide a more meaningful error message when you do what you did. It’s not doing input validation.

---

<div class="post-metadata">

**Author:** ![geathan](https://avatars.discourse-cdn.com/v4/letter/g/b9e5f3/32.png) [@geathan](https://forums.powershell.org/u/geathan)\
**Post date:** [May 7, 2014, 3:37am UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542/7 "2014-05-07T03:37:11Z")

</div>

Done.

[https://connect.microsoft.com/PowerShell/feedback/details/868951/dsc-encrypted-credentials-generic-error](https://connect.microsoft.com/PowerShell/feedback/details/868951/dsc-encrypted-credentials-generic-error)

Thanks again for the help.

---

<div class="post-metadata">

**Author:** ![edmondtang](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/edmondtang/32/712_2.png) [@edmondtang](https://forums.powershell.org/u/edmondtang)\
**Post date:** [December 17, 2015, 6:26am UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542/8 "2015-12-17T06:26:30Z")

</div>

Having the same issue. Took the OP’s code change the nodename, members and included the CertificateId. Confirmed the machine that builds the mof had the same certificate/thumbprint as the server. We even generated the mof and started DSC on the target server, but we still get this error:

Job {03F26B40-A4F7-11E5-80D9-005056BE26AD} :  
This event indicates that a non-terminating error was thrown when DSCEngine was executing Test-TargetResource on MSFT\_GroupResource DSC resource. FullyQualifiedErrorId is COMException. ErrorMessage is Exception calling “FindByIdentity” with “2” argument(s): "The user name or password is incorrect.  
".

How can we determine what username and password combination DSC tried to use?

---

<div class="post-metadata">

**Author:** ![edmondtang](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/edmondtang/32/712_2.png) [@edmondtang](https://forums.powershell.org/u/edmondtang)\
**Post date:** [December 18, 2015, 2:55am UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542/9 "2015-12-18T02:55:00Z")

</div>

Forgot to call Set-DscLocalConfigurationManager.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 9:17pm UTC](https://forums.powershell.org/t/group-resource-encrypted-credentials-issue/2542/10 "2024-05-16T21:17:09Z")

</div>

Closed on May 16, 2024, 9:17pm UTC