locked
New-CsAnalogDevice from a non domain joined machine RRS feed

  • Question

  • Hi

    I tend to do my management operations using Powershell Remoting uisng New-PSSection with the appropriate connectionUri

    session = New-PSSession -connectionuri https://frontend.fqdn/ocspowershell -Credential $cred 

    If I do this from a machine that's not in the Skype for Business Domain, I have to use the -DomainController option to specify a DC for operations that modify AD (e.g. Set-CsAnalogDevice). But.. for New-CsAnalogDevice this parameter is missing, resulting in your usual

    Active Directory operation failed on "dc.domain.com". You cannot retry this operation: "Access is denied
    00000005: SecErr: DSID-03152487, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
    "

    error. The same goes for Remove-CsAnalogDevice. Weirdly enough, Set-CsAnalogDevice does support -DomainController so updating a device works..it's just add and remove that don't.

    Now of course you will say "RDP into a domain joined machine and run it there" and of course that works, but that's not always possible.

    Any ideas?

    Thanks

    Stephan

    Thursday, January 19, 2017 7:52 PM

Answers

  • Well, I do have the right answer now.

    Whether or not you're in a domain doesn't matter. What does is that the OU you're trying to create CsAnalogDevices in has its rights updated using Grant-CsOuPermission

    Grant-CsOuPermission -ObjectType "device" -ou "path to OU here".

    Wednesday, February 1, 2017 2:22 PM

All replies

  • Hi Stephan,

    When we run New-CsAnalogDevice and Remove-CsAnalogDevice, there is no -DomainController parameter with those commands, so we could not use -DomainController parameter in two commands:
    https://technet.microsoft.com/en-us/library/gg412937.aspx
    https://technet.microsoft.com/en-us/library/gg398433.aspx

    But when we run Set-CsAnalogDevice cmdlet, we could use -DomainController parameter as the following link:
    https://technet.microsoft.com/en-us/library/gg412843.aspx


    Best Regards,
    Jim Xu
    TechNet Community Support


    Please remember to mark the replies as answers if they helped.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
    • Edited by jim-xu Friday, January 20, 2017 2:22 AM
    • Proposed as answer by jim-xu Friday, February 3, 2017 8:44 AM
    Friday, January 20, 2017 2:22 AM
  • I think I formulated my question not clear enough.. 

    It is.. given the lack of -DomainController on New-CsAnalogDevice and Remove-CsAnalogDevice, what options are there to perform those actions from a non domain joined machine?

    Monday, January 23, 2017 11:10 AM
  • Well, I do have the right answer now.

    Whether or not you're in a domain doesn't matter. What does is that the OU you're trying to create CsAnalogDevices in has its rights updated using Grant-CsOuPermission

    Grant-CsOuPermission -ObjectType "device" -ou "path to OU here".

    Wednesday, February 1, 2017 2:22 PM
  • Hi Stephan,

    Thanks for your sharing and we are glad to hear this issue has been solved. However, I think my reply is helpful to you, could you mark my reply as answer?


    Best Regards,
    Jim Xu
    TechNet Community Support


    Please remember to mark the replies as answers if they helped.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, February 3, 2017 8:48 AM