"Access is denied" when running Invoke-ArcGISConfiguration

[vassilo]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request

Module Version

• 4.0.0

Affected Resource(s)

• ArcGIS_Server
• ArcGIS_Portal
• ArcGIS_DataStore
• ArcGIS_WebAdaptor

Configuration Files

{
    "AllNodes": [
        {
            "NodeName": "wcg-cube-age",
            "Role": [
                "Server",
                "Portal",
                "DataStore",
                "ServerWebAdaptor",
                "PortalWebAdaptor",
                "SQLServerClient"
            ],
            "DataStoreTypes": [
                "Relational"
            ]
        }
    ],
    "ConfigData": {
        "Version": "10.9.1",
        "ServerContext": "hosting",
        "PortalContext": "portal",
        "ServerRole": "GeneralPurposeServer",
        "DownloadSetups": false,
        "DownloadPatches": false,
        "Credentials": {
            "ServiceAccount": {
                "UserName": "svc-arcgis",
                "Password": "<removed>"
                "IsDomainAccount": false,
                "IsMSAAccount": false
            },
            "AGOCredential":{
                "UserName": "dsc_deployer",
                "Password": "<removed>"
            }
        },
        "Server": {
            "LicenseFilePath": "D:\\Esri\\Licenses\\EsriZA_2022-2024_ArcGISGISServerAdvanced.ecp",
            "Installer": {
                "Path": "D:\\Esri\\Software\\Installs_DSC\\ArcGIS_Server_Windows_1091_180041.exe",
                "InstallDir": "C:\\Program Files\\ArcGIS\\Server",
                "InstallDirPython": "C:\\Python27",
                "PatchesDir": "D:\\Esri\\Software\\Patches_DSC\\Server",
                "PatchInstallOrder": [
                    "ArcGIS-1091-S-SP-Patch.msp",
                    "ArcGIS-1091-S-MR-PatchB.msp",
                    "ArcGIS-1091-S-Log4j-Patch.msp",
                    "ArcGIS-1091-S-VRPG-Patch.msp",
                    "ArcGIS-1091-DIS-Log4j-Patch.msp"
                ],
                "EnableArcMapRuntime": "false",
                "EnableDotnetSupport": "true"
            },            
            "ServerDirectoriesRootLocation": "D:\\arcgis\\hosting\\directories",
            "ConfigStoreLocation": "D:\\arcgis\\hosting\\config-store",
            "LocalRepositoryPath": "D:\\arcgis\\hosting\\local",
            "ServerLogsLocation": "D:\\arcgis\\hosting\\logs",
            "PrimarySiteAdmin": {
                "UserName": "siteadmin",
                "Password": "<removed>"
            },
            "ExternalLoadBalancer": "wcg-cube-age.<removed>"
        },
        "Portal": {
            "LicenseFilePath": "D:\\Temp\\Licenses\\EsriZA_2022-2024_ArcGIS_Enterprise_Portal_1091_389587_20220722.json",
            "Installer": {
                "Path": "D:\\Esri\\Software\\Installs_DSC\\Portal_for_ArcGIS_Windows_1091_180052.exe",
                "WebStylesPath": "D:\\Esri\\Software\\Installs_DSC\\Portal_for_ArcGIS_Web_Styles_Windows_1091_180053.exe",
                "InstallDir": "C:\\Program Files\\ArcGIS\\Portal",
                "ContentDir": "D:\\arcgis\\portal",
                "PatchesDir": "D:\\Esri\\Software\\Patches_DSC\\Portal",
                "PatchInstallOrder": [
                    "ArcGIS-1091-PFA-Log4j-Patch.msp"
                ]
            },
            "PortalLicenseUserTypeId": "creatorUT",
            "DefaultRoleForUser": "iAAAAAAAAAAAAAAA",
            "DefaultUserLicenseTypeIdForUser": "viewerUT",
            "EnableAutomaticAccountCreation": false,
            "PortalAdministrator": {
                "UserName": "portaladmin",
                "Email": "[email protected]",
                "Password": "<removed>",
                "SecurityQuestionIndex": 1,
                "SecurityAnswer": "<removed>"
            },
            "ContentDirectoryLocation":"D:\\arcgis\\portal\\content",
            "ExternalLoadBalancer": "wcg-cube-age.<removed>"
        },
        "DataStore": {
            "ContentDirectoryLocation": "D:\\arcgis\\datastore",
            "EnableFailoverOnPrimaryStop": false,
            "EnablePointInTimeRecovery": false,
            "Installer": {
                "Path": "D:\\Esri\\Software\\Installs_DSC\\ArcGIS_DataStore_Windows_1091_180054.exe",
                "InstallDir": "C:\\Program Files\\ArcGIS\\DataStore",
                "PatchesDir": "D:\\Esri\\Software\\Patches_DSC\\Datastore",
                "PatchInstallOrder": [
                    "ArcGIS-1091-DS-Log4j-Patch.msp"
                ]
            }
        },
        "WebAdaptor": {
            "AdminAccessEnabled": true,
            "Installer": {
                "Path": "D:\\Esri\\Software\\Installs_DSC\\ArcGIS_Web_Adaptor_for_Microsoft_IIS_1091_180055.exe",
                "PatchesDir": "D:\\Esri\\Software\\Patches_DSC\\Webadaptor",
                "PatchInstallOrder": [
                ]
            },
            "WebSiteId": 1
        },
        "SQLServerClient": [
            {
                "Name": "Microsoft ODBC Driver 17 for SQL Server",
                "InstallerPath": "D:\\Esri\\Software\\Installs_DSC\\msodbcsql_17.8.1.1_x64.msi",
                "ProductId": "7453C0F5-03D5-4412-BB8F-360574BE29AF",
                "Arguments": " /quiet /qn IACCEPTMSODBCSQLLICENSETERMS=YES ADDLOCAL=ALL"
            }
        ]
    }
}

Expected Behavior

The expected behaviour is for the script to execute and complete without any errors.

Actual Behavior

PS C:\Deployments\dpa_dsc\WCG-CUBE-AGE> Invoke-ArcGISConfiguration -ConfigurationParametersFile "C:\Deployments\dpa_dsc\WCG-CUBE-AGE\BaseDeployment-SingleMachine.json" -Mode Install -DebugSwitch

Dot Sourcing the Configuration:- ArcGISInstall Starting DSC Job:- ArcGISInstall VERBOSE: Time taken for configuration job to complete is 0.032 seconds 2022/09/14 13:57:19: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = SendConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'. 2022/09/14 13:57:24: Operation 'Invoke CimMethod' complete. Trace-DSCJob : 2022/09/14 13:57:24: Access is denied. At C:\Program Files\WindowsPowerShell\Modules\ArcGIS\4.0.0\ArcGIS.psm1:261 char:5

• Trace-DSCJob -Job $Job -JobName $ConfigurationName -DebugMode $De ...
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
  • FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Trace-DSCJob

Logs Directory: C:\Deployments\dpa_dsc\WCG-CUBE-AGE\Logs Finished DSC Job:- ArcGISInstall. Time Taken - 00:00:05.0860640 ArcGISInstall - Failed

Steps to Reproduce

Run the Invoke-ArcGISConfiguration script

Important Factoids

1. Non of the machines involved are on a Windows domain.
2. The Invoke-ArcGISConfiguration script is getting executed from a Windows 11 machine.
3. The target machine is a Windows Server 2022 machine.
4. The install binaries are local on the target machine. Not via a network share or mapped derived.
5. I have gone through all the other "Access denied" issues.
6. The IPs, the FQDN, and the short server name are all in the TrustedHosts entry on both machines.
7. I have attached the log files that get generated.

ArcGISInstall-2022-09-14-13-57-19-Error.txt ArcGISInstall-2022-09-14-13-57-19-Verbose.txt

[ZianAtFirstWatch]

I had the same problem and worked around it by running PowerShell as Administrator. Then, I ran Invoke-ArcGISConfiguration.

In my case, I was already using -Credential to pass in the credentials of a user who is in the local Administrators group on the server.

[vassilo]

I had the same problem and worked around it by running PowerShell as Administrator. Then, I ran Invoke-ArcGISConfiguration.

In my case, I was already using -Credential to pass in the credentials of a user who is in the local Administrators group on the server.

I am running the PowerShell as administrator. Are your machines on a domain, and was the user you passed through also a domain user?

[ZianAtFirstWatch]

Yes, the computers are on a domain. No, the user is not a domain user. It is a local administrative account.

[cameronkroeker]

@vassilo Since the nodes are not on a domain, you may need to run powershell as a local administrator account (right click run as an administrator), and pass in a common local administrator account (create a local admin account on the orchestrating machine and target machine that contain the same username and password) for the -Credenital parameter.