New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Error during machine sid retrieval: An error (1788) occurred while enumerating the group membership. The member's SID could not be resolved. #606
Comments
Are you able to try this out and see if it fails in the same way, if so what exact line is failing? $adminGroup = (New-Object -TypeName System.Security.Principal.SecurityIdentifier -ArgumentList @(
"S-1-5-32-544")).Translate([System.Security.Principal.NTAccount]).Value
$namespace = 'System.DirectoryServices.AccountManagement'
Add-Type -AssemblyName $namespace
$context = New-Object -TypeName "$namespace.PrincipalContext" -ArgumentList @(
[System.DirectoryServices.AccountManagement.ContextType]::Machine)
$principal = New-Object -TypeName "$namespace.GroupPrincipal" -ArgumentList $context, $adminGroup
$searcher = New-Object -TypeName "$namespace.PrincipalSearcher" -ArgumentList $principal
$groups = $searcher.FindOne()
$groupMembers = $groups.Members.GetEnumerator()
$i = 0
while ($true) {
try {
if (-not $groupMembers.MoveNext()) {
break
}
$g = $groupMembers.Current
Write-Host "Group [$i] $($g.Name) - $($g.Sid)"
}
catch {
Write-Host "Failed to enumerate group at ${i}: $_"
}
$i++
} Do you see a group with a SID that ends with |
I've been seeing this same issue for over a year now. I ran the script @jborean93 provided. it produced no errors, and i do see an account with a SID ending with -500. |
@rhophi2000 so you've been seeing the issue but the above code didn't have any problems, specifically it didn't show ansible.windows/plugins/modules/setup.ps1 Lines 847 to 864 in f1f2bcb
|
Hi all, after quite a bit of research, I can now give you a summary of my findings: First I tried to find out what the non-resolvable SIDs were. Turns out, you can enumerate them with ADSI:
Trying to further understand why a seemingly local group on a freshly installed DC contains unresolvable SIDs, I found out that on a DC, $adminGroup will contain the AD administrator group, not a local group. This is the case even if the AD administrators group was renamed. You can verify this by comparing It seems like the appropriate way to determine machine SID on a DC would be to use:
I have checked whether the Active-Directory Powershell Module is always installed on DCs, which seem to be the case, even if installing Looking forward to hearing your thoughts @jborean93 |
SUMMARY
For some reason, one of my hosts (a domain controller) is producing this warning during facts gathering:
[WARNING]: Error during machine sid retrieval: An error (1788) occurred while enumerating the group membership. The member's SID could not be resolved.
I was able to reproduce this error by manually executing the code
ansible.windows/plugins/modules/setup.ps1
Lines 847 to 857 in f1f2bcb
and then trying to list
$group.Members
.$adminGroup
contains the stringBUILTIN\Administratoren
.However, I am unable to see the members of this group, since the affected server is a domain controller, and has no local groups.
get-localgroup $adminGroup
returnsget-localgroup : Group BUILTIN\Administratoren was not found.
.Is there any way I can fix this / list the members of this group so I can see which one is causing issues?
ISSUE TYPE
COMPONENT NAME
setup
ANSIBLE VERSION
COLLECTION VERSION
CONFIGURATION
OS / ENVIRONMENT
Target OS: windows server 2022
The text was updated successfully, but these errors were encountered: