通过JEA端点更新媒体的MDT模块无法添加BCD条目

Question

我遇到了在JEA端点上远程更新MDT离线媒体的问题.该错误与传递给BCDEdit的权限和JEA创建的虚拟帐户(WinRM User ...)有关.BCDEdit返回

尝试指定的创建操作时发生错误.此安全ID可能不会被指定为此对象的所有者.

尝试使用x64启动配置更新BCD文件时.

命令:

Invoke-Command -ComputerName $DeploymentServerName -ConfigurationName MDTUpdate -ScriptBlock { 
        New-PSDrive -Name "DS002" -PSProvider MDTProvider -Root "$Using:LocalDeploymentShareFolder" -ErrorAction Stop
        Update-MDTMedia -Path "DS002:\Media\MEDIA001" -Verbose
    } -Credential $MDTCreds -ErrorAction Stop

MDT模块运行的命令:

'C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\AMD64\BCDBoot\bcdedit.exe' -store "C:\MyVMs\MDT\USB\Content\Boot\bcd" /create "{f31cce1a-e314-4481-9ac9-e519f65dff65}" -d "Litetouch Boot [MEDIA001] (x64)" -application OSLOADER

JEA成绩单出错:

VERBOSE: Error detected running command: 'C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\AMD64\BCDBoot\bcdedit.exe -store "C:\MyVMs\MDT\USB\Content\Content\Boot\bcd" /create "{f31cce1a-e314-4481-9ac9-e519f65dff65}" -d "Litetouch Boot [MEDIA001] (x64)" -application OSLOADER' Exit code is: 1
VERBOSE: Error text is: An error occurred while attempting the specified create operation.  This security ID may not be assigned as the owner of this object.
Update-MDTMedia : BcdEdit returned an error.
At line:5 char:9
+         Update-MDTMedia -Path "DS002:\Media\MEDIA001" -Verbose
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (MEDIA001:String) [Update-MDTMedia], DeploymentPointException
    + FullyQualifiedErrorId : BcdEditError,Microsoft.BDD.PSSnapIn.GenerateMDTMedia

会话配置中的相关信息:

@{
    SchemaVersion = '2.0.0.0'
    SessionType = 'Default'
    ExecutionPolicy = 'Unrestricted'
    LanguageMode = 'FullLanguage'
    TranscriptDirectory = 'C:\JEA\Transcripts'
    RunAsVirtualAccount = $true
    RoleDefinitions = @{
        'ExampleDomain\ExampleUserOrGroup' = @{
            'RoleCapabilities' = 'MDTUpdate'  
        } 
    }
}

角色配置的相关内容:

@{
ModulesToImport = 'C:\Program Files\Microsoft Deployment Toolkit\Bin\MicrosoftDeploymentToolkit.psd1'
VisibleCmdlets = 'Get-Command','Out-Default','Exit-PSSession','Measure-Object','Select-Object','Get-FormatData','Start-Transcript','Stop-Transcript','Import-Module','Get-Module','New-PSDrive','Write-Output','Update-MDTDeploymentShare','Remove-Item','Update-MDTMedia','New-Item','Remove-PSDrive'
VisibleProviders = 'FileSystem', 'MDTProvider'
VisibleExternalCommands = 'bcdedit.exe'
}

在虚拟帐户下运行时,如何为BCDEdit提供适当的权限？或者我是否必须删除JEA并授予服务帐户本地管理员权限并在默认PSSession下运行它？

Answer 1

我想到的事情是确保该帐户所属的组不仅具有只读权限。我曾经遇到过这样的情况：我可以运行任何 powershell 命令，但是当调用非 powershell 本机程序时，它会给我带来权限问题。

除此之外唯一的另一件事是在脚本块中使用 runas，但这有点违背了 JEA 的整体目的。