Is it just me but WMF 5.0 JEA constraint endpoint is broken beyound repair

This topic contains 9 replies, has 3 voices, and was last updated by Profile photo of GS GS 10 months, 3 weeks ago.

  • Author
    Posts
  • #34103
    Profile photo of GS
    GS
    Participant

    Not only WMF 5.0 come with no documentation available whatsover for JEA ConstrainedEndpoint (try get-help New-PSSessionConfigurationFile -Parameter RunAsVirtualAccount)
    But also none of those settings work!
    Example below check endpoint called "jea" and it's property RunAsVirtualAccount. Then reads config file and checks what actually config file is set to which shows those parameters are not being processed at all. WMF 5.0 RTM is total disaster, half of the stuff does not work (in addition for being pulled for other reasons). I raised bugs in UserVoice but there is no move on those either.

    [ADMIN]: PS > $a = Get-PSSessionConfiguration -name jea | Select ConfigFilePath, RunAsVirtualAccount
    [ADMIN]: PS > $a
    
    ConfigFilePath                                                                                         RunAsVirtualAcco
                                                                                                           unt
    ————–                                                                                         —————-
    C:\Windows\System32\WindowsPowerShell\v1.0\SessionConfig\jea_ebf878f7-4829-4f95-8e60-e6999adbbb8a.pssc True
    
    
    [ADMIN]: PS > Get-content $a.ConfigFilePath | select-String "RunAsVirtualAccount"
    
     RunAsVirtualAccount = $false
    
  • #34117
    Profile photo of Tim Pringle
    Tim Pringle
    Participant

    Hey GS,

    Interesting verbage.. 😉

    I've not had any problems with it. Can you try this? My results are below as well.

    New-PSSessionConfigurationFile -VisibleCmdlets Get-* -Path .\GetSessions.pssc -RunAsVirtualAccount -Force
    Register-PSSessionConfiguration -Name GetOnly -Path .\GetSessions.pssc -Force
    $a = Get-PSSessionConfiguration -Name GetOnly | select ConfigFilePath,RunAsVirtualAccount
    get-content $a.ConfigFilePath | Select-String "RunAsVirtualAccount"
    PS C:\> $a
    

    ConfigFilePath RunAsVirtualAccount
    ————– ——————-
    C:\Windows\System32\WindowsPowerShell\v1.0\SessionConfig\GetOnly_d2a817d7-00aa-412e-a70d-cc583a6b25f6.pssc True

    C:\> get-content $a.ConfigFilePath | Select-String "RunAsVirtualAccount"
    

    RunAsVirtualAccount = $true
    # RunAsVirtualAccountGroups = 'Remote Desktop Users', 'Remote Management Users'

  • #34118
    Profile photo of GS
    GS
    Participant

    Thanks,

    This works on Windows 2012 R2 machine but no on Windows 8.1 machine. Both computers are having PS 5.0 RTM on them.
    Also would you mind testing if file created is valid? Shows as invalid for me

    PS C:\Windows\system32> Test-PSSessionConfigurationFile .\a.pssc -Verbose
    VERBOSE: The member 'RunAsVirtualAccount' is not a valid key. Please change the member to a valid key in the file
    C:\Windows\system32\a.pssc.
    False
    

    .

  • #34122
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    What edition of Windows 8.1 are you running? Virtual accounts may be one of those features only available in Enterprise / Professional / Whatever. Need to track down those details.

  • #34123
    Profile photo of GS
    GS
    Participant

    I run Win 8.1 Enterprise edition. Also as you can see above Test-PSSessionConfigurationFile even considers RunAsVirtualAccount parameter not valid in configuration file even on Windows 2012.

  • #34124
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    Hmm, weird. You may get the standard "the X is for Experimental" response for why xJea isn't quite there yet, but I'll send a mail to the MVP list with a link to this thread.

  • #34125
    Profile photo of GS
    GS
    Participant

    This is RTM version of Powershell, I don't think any of the parts of it are considered to be still Experimental. I deployed it in production and found half of the stuff is not working with Remoting in addition to missing helpfiles etc.

  • #34126
    Profile photo of Tim Pringle
    Tim Pringle
    Participant

    @Dave Get the same with this using Win 10 (11099.rs1_release.160109-1156)

    I had a look, at the problem is because there is a validation process done in Test-PSConfigurationFile which is not working as it should.

    Test-PSSessionConfiguration file calls a method VerifyConfigTable, which as part of its validation routine checks against a set of constants contained in a collection, ConfigTypeEntry. RunAsVirtualAccount isn't in this list.

    I'll see if i can get any more information on this.

  • #34127
    Profile photo of Tim Pringle
    Tim Pringle
    Participant

    System.Management.Automation.Remoting.ConfigFileConstants.ConfigFileKeys is the full qualified name

  • #34128
    Profile photo of GS
    GS
    Participant

    I opened a bug about it here sometime back as well https://windowsserver.uservoice.com/forums/301869-powershell/suggestions/11234487-new-pssessionconfigurationfile-does-not-create-wel
    I also can not seem to be able change RunAsVirtualAccount value on Windows 2012 either after modifiying PSSC file and restarting WinRM changes to that switch are not reflected in session. Can you confirm?

You must be logged in to reply to this topic.