8

我在 JEA 端点上远程更新 MDT 离线媒体时遇到问题。该错误与传递给 BCDEdit 的权限和 JEA（WinRM 用户...）创建的虚拟帐户有关。BCDEdit 返回

尝试指定的创建操作时出错。此安全 ID 不得指定为此对象的所有者。

尝试使用 x64 引导配置更新 BCD 文件时。

命令：

Invoke-Command -ComputerName $DeploymentServerName -ConfigurationName MDTUpdate -ScriptBlock { 
        New-PSDrive -Name "DS002" -PSProvider MDTProvider -Root "$Using:LocalDeploymentShareFolder" -ErrorAction Stop
        Update-MDTMedia -Path "DS002:\Media\MEDIA001" -Verbose
    } -Credential $MDTCreds -ErrorAction Stop

MDT 模块运行的命令：

'C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\AMD64\BCDBoot\bcdedit.exe' -store "C:\MyVMs\MDT\USB\Content\Boot\bcd" /create "{f31cce1a-e314-4481-9ac9-e519f65dff65}" -d "Litetouch Boot [MEDIA001] (x64)" -application OSLOADER

来自 JEA 成绩单的错误：

VERBOSE: Error detected running command: 'C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\AMD64\BCDBoot\bcdedit.exe -store "C:\MyVMs\MDT\USB\Content\Content\Boot\bcd" /create "{f31cce1a-e314-4481-9ac9-e519f65dff65}" -d "Litetouch Boot [MEDIA001] (x64)" -application OSLOADER' Exit code is: 1
VERBOSE: Error text is: An error occurred while attempting the specified create operation.  This security ID may not be assigned as the owner of this object.
Update-MDTMedia : BcdEdit returned an error.
At line:5 char:9
+         Update-MDTMedia -Path "DS002:\Media\MEDIA001" -Verbose
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (MEDIA001:String) [Update-MDTMedia], DeploymentPointException
    + FullyQualifiedErrorId : BcdEditError,Microsoft.BDD.PSSnapIn.GenerateMDTMedia

来自会话配置的相关信息：

@{
    SchemaVersion = '2.0.0.0'
    SessionType = 'Default'
    ExecutionPolicy = 'Unrestricted'
    LanguageMode = 'FullLanguage'
    TranscriptDirectory = 'C:\JEA\Transcripts'
    RunAsVirtualAccount = $true
    RoleDefinitions = @{
        'ExampleDomain\ExampleUserOrGroup' = @{
            'RoleCapabilities' = 'MDTUpdate'  
        } 
    }
}

角色配置中的相关内容：

@{
ModulesToImport = 'C:\Program Files\Microsoft Deployment Toolkit\Bin\MicrosoftDeploymentToolkit.psd1'
VisibleCmdlets = 'Get-Command','Out-Default','Exit-PSSession','Measure-Object','Select-Object','Get-FormatData','Start-Transcript','Stop-Transcript','Import-Module','Get-Module','New-PSDrive','Write-Output','Update-MDTDeploymentShare','Remove-Item','Update-MDTMedia','New-Item','Remove-PSDrive'
VisibleProviders = 'FileSystem', 'MDTProvider'
VisibleExternalCommands = 'bcdedit.exe'
}

在虚拟帐户下运行时，如何授予 BCDEdit 适当的权限？还是我必须放弃 JEA 并授予服务帐户本地管理员权限并在默认 PSSession 下运行它？

4

1 回答 1

2

想到的事情是确保该帐户所属的组不仅仅是只读权限。我曾经遇到过可以运行任何 powershell 命令的情况，但是当涉及到调用非 powershell 本机程序时，它会给我带来权限问题。

除此之外，唯一的另一件事是在脚本块中使用 runas，但这有点违背 JEA 的全部目的。

于 2017-09-20T03:51:57.457 回答