We just recently started an Azure Local deployment and during validation, the LCM creates the CNO, but fails to apply the permissions granting the CNO full control over the lcm account. This happens as part of this script: C:\NugetStore\Microsoft.AS.Infra.Security.Domain.10.2604.0.42\content\Deployment\Domain.psm1
Unfortunately, the LCM doesn't have full control over the OU to be able to grant it to the CNO. The predeployment script only grants the lcm limited permissions:
|
$ace1 = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $cno.SID, "CreateChild", "Allow", $computersObjectType, "All" |
I'd offer a pull request, but the Contribution guidelines link doesn't work. Also, pull requests seem pretty stale.
We just recently started an Azure Local deployment and during validation, the LCM creates the CNO, but fails to apply the permissions granting the CNO full control over the lcm account. This happens as part of this script: C:\NugetStore\Microsoft.AS.Infra.Security.Domain.10.2604.0.42\content\Deployment\Domain.psm1
Unfortunately, the LCM doesn't have full control over the OU to be able to grant it to the CNO. The predeployment script only grants the lcm limited permissions:
AzureStack-Tools/HCI/AsHciADArtifactsPreCreationTool.psm1
Line 614 in 8fd59ad
I'd offer a pull request, but the Contribution guidelines link doesn't work. Also, pull requests seem pretty stale.