We have a windows domain infrastructure deployed on AWS EC2 instances. What we want to achieve is to create a custom sysprepped image that when launching new instances those instances will auto join the domain and then rename themselves based on the region, availability zone and server name defined in AWS console.
The first step is already implemented by using the join domain component added to sysprep2008.xml like below:
<component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://ift.tt/1gZfvUg" xmlns:xsi="http://ift.tt/ra1lAU">
<Identification>
<UnsecureJoin>False</UnsecureJoin>
<Credentials>
<Domain>dc.connatix.com</Domain>
<Password>####</Password>
<Username>####</Username>
</Credentials>
<JoinDomain>####</JoinDomain>
<MachineObjectOU>OU=Servers,DC=dc,DC=####,DC=com</MachineObjectOU>
</Identification>
</component>
For the rename operation we tried a lot of options: 1. execute a powershell script after sysprep that will retrieve a list of scripts to be applied from the domain controller and execute them one by one but Get-AdDomainController returns nothing in this step 2. Add a scheduled task through group policy that will execute this script: this is not working since we cannot add a task that will run under domain admin account through group policy 3. Add a startup script through group policy but again this is not running under the domain admin account.
The script used in all those scenarios is below and it's running great when running from an authenticated user.
$mypwd = ConvertTo-SecureString -String "####" -Force -AsPlainText
$mycreds = New-Object System.Management.Automation.PSCredential ("####", $mypwd)
Set-AWSCredentials -AccessKey #### -SecretKey #### -StoreAs default
$InstanceId = (Invoke-RestMethod 'http://ift.tt/N6UOsk').ToString()
$AvailabilityZone = (Invoke-RestMethod 'http://ift.tt/1lcAxuq').ToString().ToLower()
$Region = $AvailabilityZone.Substring(0,$AvailabilityZone.Length-1)
$computer = Get-WmiObject Win32_ComputerSystem
$Tags = Get-EC2Tag -Filters @{Name='resource-id';Value=$InstanceId} -Region $Region
$InstanceName = $AvailabilityZone + '-' + ($Tags | Where-Object {$_.Key -eq 'Name'}).Value.ToLower()
$computerName = $computer.Name.ToLower();
If($InstanceName -ne $null) {
If ($computerName -ne $InstanceName) {
Rename-Computer -NewName $InstanceName -DomainCredential $mycreds -Restart
}
}
How do you think we can accomplish this? Thank you in advance
Aucun commentaire:
Enregistrer un commentaire