XDnsServerAdZone: Removing or Fixing Call to New-CimSession

[TraGicCode]

Currently we only have winrm configured to listen on loopback ONLY with the following below settings

Unfortunately the XDnsServerAdZone DSC resource creates a new-cimsession in the Get-TargetResource function. This ends up resolving to the ip of the nic of the machine. Therefore the cimsession to connect will fail since it's not connecting VIA loopback address configured above for the winrm listener. Below is the error i'm getting

Could not evaluate: Cannot validate argument on parameter 'CimSession'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again

1.) Why is New-CimSession even needed here? can it be removed?
2.) If New-CimSession cannot be removed can we allow passing in of the ip to create the cimsession for?

[greggoindenver]

I can confirm the same error message even with no winrm constraints in place.

[TraGicCode]

@greggoindenver Do you have any ideas as to why a new-cimsession is being used in this dsc resource?

[TraGicCode]

@corydwood Maybe you could shed some light on this

[corydwood]

New-CimSession is being used to allow creating zones on remote DNS servers and/or using specific credentials for creating the zone on either the local server or a remote server.

The code could be changed to only use New-CimSession if the ComputerName or Credential parameters are used. I can look into doing that, but may not be able to get to it for a few days.

[corydwood]

Also, it looks like #49 broke this resource as the Set-TargetResource function relies on the CimSession property being returned by the call to Get-TargetResource.

[TraGicCode]

@corydwood I might be able to get around to doing this as well.. Cannot promise anything depend on how my schedule goes.

[Sawal72]

We have the same problem with version 1.8.0.0. Version 1.7.0.0 works fine.

[greggoindenver]

Has there been any further status on this issue?

[jpuskar]

+1, same repro

[greggoindenver]

@corydwood, @TraGicCode : Have either of you been able to reproduce this error? I tried it again today on a different machine. I can create forward zones, but not reverse zones.

[ejleroy]

I had the same issue "Cannot validate argument on parameter 'CimSession'"
Workaround was to comment out the CimSession (line 240)
C:\Program Files\WindowsPowerShell\Modules\xDnsServer\1.9.0.0\DSCResources\MSFT_xDnsServerADZone\MSFT_xDnsServerADZone.psm1

Should only add the CimSession parameter if the computername attribute was set on the resource.

[ejleroy]

Update: This problem still exists.

I've updated the following lines as a proposed solution:
Removed line 240 (see previous comment screenshot).
Added (before line 242):

if($targetResource.CimSession) 
{
	$addParams += @{
                    CimSession = $targetResource.CimSession
        }
}

Also, under ($targetResource.Ensure -eq 'Present'):

## Update the existing zone
            $updateParams = @{
                Name = $targetResource.Name
            }
	    if($targetResource.CimSession) 
	    {
		 $addParams += @{
                    CimSession = $targetResource.CimSession
            }

(Please forgive the formatting)

[regedit32]

@ejleroy your fix looks good. Are you going to create a pull request with it?

[regedit32]

Also, the $targetResource returned by Get-TargetResource doesn't actually include CimSession, so we should probably just create the CimSession if needed in the Set-TargetResource. Otherwise, as-is, the CimSessions are being created for each zone, but never being removed.

[ejleroy]

Made some more changes based on your feedback. Going to test this out hopefully tomorrow and create a pull request if it looks okay. Basically, we'll only use CimSession (in Get and Set) if needed (based on if ComputerName is passed in) and remove any CimSessions created.

`function Get-TargetResource
{
[CmdletBinding()]
[OutputType([System.Collections.Hashtable])]
param
(
[Parameter(Mandatory)]
[ValidateNotNullOrEmpty()]
[System.String]
$Name,

    [Parameter()]
    [ValidateSet('None','NonsecureAndSecure','Secure')]
    [System.String]
    $DynamicUpdate = 'Secure',

    [Parameter(Mandatory)]
    [ValidateSet('Custom','Domain','Forest','Legacy')]
    [System.String]
    $ReplicationScope,

    [Parameter()]
    [System.String]
    $DirectoryPartitionName,

    [Parameter()]
    [System.String]
    $ComputerName,

    [Parameter()]
    [pscredential]
    $Credential,

    [Parameter()]
    [ValidateSet('Present','Absent')]
    [System.String]
    $Ensure = 'Present'
)
Assert-Module -Name 'DNSServer'
Write-Verbose ($LocalizedData.CheckingZoneMessage -f $Name, $Ensure)
$getParams = @{
    Name = $Name
    ErrorAction = 'SilentlyContinue'
}
if ($ComputerName)
{
	$cimSessionParams = @{ErrorAction = 'SilentlyContinue'}
    $cimSessionParams += @{ComputerName = $ComputerName}
	if ($Credential)
	{
		$cimSessionParams += @{Credential = $Credential}
	}
	$cimSession = New-CimSession @cimSessionParams
	$getParams += @{CimSession = $cimSession}
}
$dnsServerZone = Get-DnsServerZone @getParams
if($ComputerName) {
	Remove-CimSession $cimSession
}

$targetResource = @{
    Name = $dnsServerZone.ZoneName
    DynamicUpdate = $dnsServerZone.DynamicUpdate
    ReplicationScope = $dnsServerZone.ReplicationScope
    DirectoryPartitionName = $dnsServerZone.DirectoryPartitionName
    Ensure = if ($null -eq $dnsServerZone) { 'Absent' } else { 'Present' }
}
return $targetResource

}`

`function Set-TargetResource
{
[CmdletBinding()]
param
(
[Parameter(Mandatory)]
[ValidateNotNullOrEmpty()]
[System.String]
$Name,

    [Parameter()]
    [ValidateSet('None','NonsecureAndSecure','Secure')]
    [System.String]
    $DynamicUpdate = 'Secure',

    [Parameter(Mandatory)]
    [ValidateSet('Custom','Domain','Forest','Legacy')]
    [System.String]
    $ReplicationScope,

    [Parameter()]
    [System.String]
    $DirectoryPartitionName,

    [Parameter()]
    [System.String]
    $ComputerName,

    [Parameter()]
    [pscredential]
    $Credential,

    [Parameter()]
    [ValidateSet('Present','Absent')]
    [System.String]
    $Ensure = 'Present'
)
Assert-Module -Name 'DNSServer'
$targetResource = Get-TargetResource @PSBoundParameters
if ($Ensure -eq 'Present')
{
    if ($targetResource.Ensure -eq 'Present')
    {
        ## Update the existing zone
        $updateParams = @{
            Name = $targetResource.Name
        }
		if ($ComputerName)
		{
			$cimSessionParams = @{ErrorAction = 'SilentlyContinue'}
			$cimSessionParams += @{ComputerName = $ComputerName}
			if ($Credential)
			{
				$cimSessionParams += @{Credential = $Credential}
			}
			$cimSession = New-CimSession @cimSessionParams
			$updateParams += @{CimSession = $cimSession}
		}
        if ($targetResource.DynamicUpdate -ne $DynamicUpdate)
        {
            $updateParams += @{DynamicUpdate = $DynamicUpdate}
            Write-Verbose ($LocalizedData.SetPropertyMessage -f 'DynamicUpdate')
        }
        if ($targetResource.ReplicationScope -ne $ReplicationScope)
        {
            $updateParams += @{ReplicationScope = $ReplicationScope}
            Write-Verbose ($LocalizedData.SetPropertyMessage -f 'ReplicationScope')
        }
        if ($DirectoryPartitionName -and $targetResource.DirectoryPartitionName -ne $DirectoryPartitionName)
        {
            $updateParams += @{DirectoryPartitionName = $DirectoryPartitionName}
            Write-Verbose ($LocalizedData.SetPropertyMessage -f 'DirectoryPartitionName')
        }
        Set-DnsServerPrimaryZone @updateParams
    }
    elseif ($targetResource.Ensure -eq 'Absent')
    {
        ## Create the zone
        Write-Verbose ($LocalizedData.AddingZoneMessage -f $targetResource.Name)
        $addParams = @{
            Name = $Name
            DynamicUpdate = $DynamicUpdate
            ReplicationScope = $ReplicationScope
        }
		if ($ComputerName)
		{
			$cimSessionParams = @{ErrorAction = 'SilentlyContinue'}
			$cimSessionParams += @{ComputerName = $ComputerName}
			if ($Credential)
			{
				$cimSessionParams += @{Credential = $Credential}
			}
			$cimSession = New-CimSession @cimSessionParams
			$addParams += @{CimSession = $cimSession}
		}
        if ($DirectoryPartitionName)
        {
            $addParams += @{
                DirectoryPartitionName = $DirectoryPartitionName
            }
        }
        Add-DnsServerPrimaryZone @addParams
    }
}
elseif ($Ensure -eq 'Absent')
{
    # Remove the DNS Server zone
    Write-Verbose ($LocalizedData.RemovingZoneMessage -f $targetResource.Name)
	$removeParams = @{
		Name = $targetResource.Name
		Force = $true
	}
	if ($ComputerName)
	{
		$cimSessionParams = @{ErrorAction = 'SilentlyContinue'}
		$cimSessionParams += @{ComputerName = $ComputerName}
		if ($Credential)
		{
			$cimSessionParams += @{Credential = $Credential}
		}
		$cimSession = New-CimSession @cimSessionParams
		$removeParams += @{CimSession = $cimSession}
	}
	Remove-DnsServerZone @removeParams
}
if($ComputerName) {
	Remove-CimSession $cimSession
}

}`