Powershell script on Midserver / credentials are failing

[hans-joerg]

Hallo all,

I was reading lots of White papers regarding credentials and found also a lot of threats regarding missed credentials but I did not got an answer yet.

I want to run a simple powershell test script on a midserver.

I am using the Service now test lab   / Version Kingston

The midserver is installed on a EC2 - AWS Client (Amazon Cloud) . The Service is started with a local Admin Account. I use this account to remote logon to the AWS Client.

Powershell   execution policy is unrestricted.

In Service Now I see the Midserver is up and validated.

I created a powershel activity;

(the target host is the internal IP of the midserver computer)

I created an alias for the credentials :

If running "test Inputs" the raw Output is pretty empty. (No screenshot)

The Output ECC-Queue shows error : "powershell_false_use_mid_servce_account":

.....

<parameter name="credential_tag" value="AWS"/>

<parameter name="credentials_debug" value="true"/><parameter name="powershell_false_use_mid_service_account" value="false"/>

<parameter name="rba_powershell_v2" value="true"/><parameter name="probe_name" value="Windows - Powershell"/></parameters>

MidServer agent log shows error (Access Denied) :

02/06/18 16:09:09 (854) ECCSender.1 Sending ecc_queue.1382b83adb441300c0eaf11ebf961961.xml

02/06/18 16:09:28 (088) Worker-Standard:PowershellProbe Worker starting: Powershell source: 172.31.12.48

02/06/18 16:09:28 (088) Worker-Standard:PowershellProbe SEVERE *** ERROR *** Failed while executing script4617295180681968705.PS1 (Access denied)

02/06/18 16:09:28 (088) Worker-Standard:PowershellProbe Enqueuing: C:\snow\agent\work\monitors\ECCSender\output_2\ecc_queue.fb92f83adb441300c0eaf11ebf9619ed.xml

02/06/18 16:09:28 (104) Worker-Standard:PowershellProbe Worker completed: Powershell source: 172.31.12.48 time: 0:00:00.000

02/06/18 16:09:28 (104) ECCSender.1 Sending ecc_queue.fb92f83adb441300c0eaf11ebf9619ed.xml

The account credentials is in the form : Workgroup\AccountName,   I tried also : Computername\AccountName

Testing the account credentials shows:

What I understand is that the connection to the midserver is correct and working. Running the script results to entries in the log of the mid server computer

What I don't understand is : Why is the authentication failed if testing the credentials directly? The account exists on the midserver and has admin privileges. The midserver service is running with this account and I can remote logon with it. Why is the execution on the MidServer Computer not accepting the configured credentials?   (There is no typo error )  

Also what I don't understand is the use of the credential tag . It seems this is not the error but why is the field only a string and not a reference to the alias record?

Please ,   does anybody had similar issues and found the solution ? DOes anybody know where to find the error or knows what it is?

Kind regards Hans-Joerg

[Hitesh targe]

I have the same issue. My MID Server and target machine is same. it is a windows box. when I click on test connection, it says authentication failed.

I have the powershell script as below. should I ignore the error and proceed?

#Load the assemblies

[System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.Protocols")

[System.Reflection.Assembly]::LoadWithPartialName("System.Net")

#Connects to

$c = New-Object System.DirectoryServices.Protocols.LdapConnection "xx.xx.xx.xx:389"

#Set session options

$c.SessionOptions.SecureSocketLayer = $false;

$c.SessionOptions.ProtocolVersion = 3

# Pick Authentication type:

$c.AuthType = [System.DirectoryServices.Protocols.AuthType]::Basic

# Username and password.

$user = "cn=test,OU=test,O=test"

$pass = "password"

$credentials = new-object "System.Net.NetworkCredential" -ArgumentList $user,$pass

# Bind with the network credentials.

$c.Bind($credentials);

# We are going to create this object (LDIF Below)

$r = (new-object "System.DirectoryServices.Protocols.AddRequest")

$r.DistinguishedName = "cn=${activityinput.user},OU=test,O=test";

#Set the desired attributes

$r.Attributes.Add( (new-object "System.DirectoryServices.Protocols.DirectoryAttribute" `

-ArgumentList "objectclass",@("person","inetorgperson") ) )

$r.Attributes.Add( (new-object "System.DirectoryServices.Protocols.DirectoryAttribute" `

-ArgumentList "givenName","test1") )

$r.Attributes.Add( (new-object "System.DirectoryServices.Protocols.DirectoryAttribute" `

-ArgumentList "sn","User1") )

$r.Attributes.Add( (new-object "System.DirectoryServices.Protocols.DirectoryAttribute" `

-ArgumentList "uid","testuser01") )

#Actually process the request through the server

$re = $c.SendRequest($r);

if ($re.ResultCode -ne [System.directoryServices.Protocols.ResultCode]::Success)

{

write-host "Failed!"

write-host ("ResultCode: " + $re.ResultCode)

write-host ("Message: " + $re.ErrorMessage)

}

any suggestions please?

[hans-joerg]

Hallo Prasa,  

What I did was that I unchecked the Box : Use mid service account 

Then the script worked fine 

[Malathi Vinoth]

How we need to create powershell activity? example how we will get above screenshot

[Community Alums]

hi,

if we have three different domain to search user using single mid server .

How can we modify the script

[Pooja Chugwani]

Powershell Action – Authentication failure with the user administrator