Azure自定义脚本扩展.以其他用户身份执行脚本 [英] Azure Custom Script Extension. Execute script as another user

问题描述

我正在使用command1.ps1脚本在目标VM上安装Azure自定义脚本扩展并执行command2.ps1. command2.ps1应该以域管理员身份运行脚本(位于ScriptBlock内部)(因此为-Credential $Credentials).当我手动运行command2.ps1并输入$ domainAdminName和$ domainAdminPassword时，它可以工作，但是当通过command1.ps1运行它时，则无法工作.可能是由于Azure自定义脚本扩展将command2.ps1作为系统帐户运行引起的吗?请帮我使脚本工作. command1.ps1:

I'm using command1.ps1 script to install Azure Custom Script Extension on the target VM and execute command2.ps1. command2.ps1 is supposed to run a script (that is inside ScriptBlock) as domain administrator (hence -Credential $Credentials). When I run command2.ps1 manually and input $domainAdminName and $domainAdminPassword it works, but when running it through command1.ps1 it doesn't work. Maybe the problem is cause by Azure Custom Script Extension running command2.ps1 as System account? Please, help me make the script work. command1.ps1:

    param
(
    [Parameter(Mandatory)]
    [String]$resourceGroupName,

    [Parameter(Mandatory)]
    [String]$targetVMname,

    [Parameter(Mandatory)]
    [String]$vmLocation,

    [Parameter(Mandatory)]
    [String]$FileUri,

    [Parameter(Mandatory)]
    [String]$nameOfTheScriptToRun,

    [Parameter(Mandatory)]
    [String]$customScriptExtensionName,

    [Parameter(Mandatory)]
    [String]$domainAdminName,

    [Parameter(Mandatory)]
    [String]$domainAdminPassword

)

Set-AzureRmVMCustomScriptExtension -Argument "-domainAdminName $domainAdminName -domainAdminPassword $domainAdminPassword" `
    -ResourceGroupName $resourceGroupName `
    -VMName $targetVMname `
    -Location $vmLocation `
    -FileUri $FileUri `
    -Run $nameOfTheScriptToRun `
    -Name $customScriptExtensionName

Remove-AzureRmVMCustomScriptExtension -Force `
    -ResourceGroupName $resourceGroupName `
    -VMName $targetVMname `
    -Name $customScriptExtensionName

command2.ps1:

command2.ps1:

    param
(
    [Parameter(Mandatory)]
    [String]$domainAdminName,

    [Parameter(Mandatory)]
    [String]$domainAdminPassword

)

$domainAdminPasswordSecureString = ConvertTo-SecureString -String $domainAdminPassword -AsPlainText -Force
$DomainCredentials = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $domainAdminName, $domainAdminPasswordSecureString

Invoke-Command -ComputerName localhost -ScriptBlock {
Start-Transcript C:\transcript1.txt
New-Item C:\111.txt 
Stop-Transcript
} -Credential $DomainCredentials

事件日志中还存在一些错误: https://i.stack.imgur.com/RKlZo.png https://i.stack.imgur.com/XL28M.png

There are also a couple of errors in the event log: https://i.stack.imgur.com/RKlZo.png https://i.stack.imgur.com/XL28M.png

推荐答案

您可以使用Azure DSC扩展来解决此问题

you can use Azure DSC extension to work around that

"properties": {
    "publisher": "Microsoft.Powershell",
    "type": "DSC",
    "typeHandlerVersion": "2.20",
    "autoUpgradeMinorVersion": true,
    "settings": {
        "configuration": {
            "url": "url",
            "script": "script.ps1",
            "function": "function"
        },
        "configurationArguments": {
            "regular": "arguments"
        }
    },
    "protectedSettings": {
        "configurationArguments": {
            "DomainCredentials": {
                "userName": "user",
                "password": "password"
            }
        }
    }

然后在您的DSC配置中添加如下参数:

And in your DSC configuration add a parameter like this:

[Parameter(Mandatory)] # doesn't have to be mandatory, just copy pasting
[System.Management.Automation.PSCredential]$DomainCredentials,

模板中的参数名称必须与dsc中的参数名称匹配.您可能可以使用powershell找出类似的东西.我个人从未尝试过，但是应该有可能.

Parameter name in the template must match parameter name in the dsc. You can probably figure out something similar using powershell. I personally never tried, but it should be possible.

这篇关于Azure自定义脚本扩展.以其他用户身份执行脚本的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！