powershell - 通过 JEA 端点更新媒体的 MDT 模块无法添加 BCD 条目

Question

我在 JEA 端点上远程更新 MDT 离线媒体时遇到问题。该错误与传递给 BCDEdit 的权限和 JEA(WinRM 用户...)创建的虚拟帐户有关。 BCDEdit 返回

An error occurred while attempting the specified create operation. This security ID may not be assigned as the owner of this object.

尝试使用 x64 引导配置更新 BCD 文件时。

命令:

Invoke-Command -ComputerName $DeploymentServerName -ConfigurationName MDTUpdate -ScriptBlock { 
        New-PSDrive -Name "DS002" -PSProvider MDTProvider -Root "$Using:LocalDeploymentShareFolder" -ErrorAction Stop
        Update-MDTMedia -Path "DS002:\Media\MEDIA001" -Verbose
    } -Credential $MDTCreds -ErrorAction Stop

MDT 模块运行的命令:

'C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\AMD64\BCDBoot\bcdedit.exe' -store "C:\MyVMs\MDT\USB\Content\Boot\bcd" /create "{f31cce1a-e314-4481-9ac9-e519f65dff65}" -d "Litetouch Boot [MEDIA001] (x64)" -application OSLOADER

来自 JEA 成绩单的错误:

VERBOSE: Error detected running command: 'C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\AMD64\BCDBoot\bcdedit.exe -store "C:\MyVMs\MDT\USB\Content\Content\Boot\bcd" /create "{f31cce1a-e314-4481-9ac9-e519f65dff65}" -d "Litetouch Boot [MEDIA001] (x64)" -application OSLOADER' Exit code is: 1
VERBOSE: Error text is: An error occurred while attempting the specified create operation.  This security ID may not be assigned as the owner of this object.
Update-MDTMedia : BcdEdit returned an error.
At line:5 char:9
+         Update-MDTMedia -Path "DS002:\Media\MEDIA001" -Verbose
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (MEDIA001:String) [Update-MDTMedia], DeploymentPointException
    + FullyQualifiedErrorId : BcdEditError,Microsoft.BDD.PSSnapIn.GenerateMDTMedia

来自 session 配置的相关信息:

@{
    SchemaVersion = '2.0.0.0'
    SessionType = 'Default'
    ExecutionPolicy = 'Unrestricted'
    LanguageMode = 'FullLanguage'
    TranscriptDirectory = 'C:\JEA\Transcripts'
    RunAsVirtualAccount = $true
    RoleDefinitions = @{
        'ExampleDomain\ExampleUserOrGroup' = @{
            'RoleCapabilities' = 'MDTUpdate'  
        } 
    }
}

角色配置中的相关内容:

@{
ModulesToImport = 'C:\Program Files\Microsoft Deployment Toolkit\Bin\MicrosoftDeploymentToolkit.psd1'
VisibleCmdlets = 'Get-Command','Out-Default','Exit-PSSession','Measure-Object','Select-Object','Get-FormatData','Start-Transcript','Stop-Transcript','Import-Module','Get-Module','New-PSDrive','Write-Output','Update-MDTDeploymentShare','Remove-Item','Update-MDTMedia','New-Item','Remove-PSDrive'
VisibleProviders = 'FileSystem', 'MDTProvider'
VisibleExternalCommands = 'bcdedit.exe'
}

在虚拟帐户下运行时，如何授予 BCDEdit 适当的权限？还是我必须放弃 JEA 并授予服务帐户本地管理员权限并在默认 PSSession 下运行它？

Answer 1

想到的事情是确保该帐户所属的组不仅仅是只读权限。我曾经遇到过可以运行任何 powershell 命令的情况，但是当涉及到调用非 powershell native 程序时，它会给我带来权限问题。

除此之外唯一的另一件事是在脚本 block 中使用 runas，但这有点违背 JEA 的全部目的。