none
Error while executing Grant-CSOUPermission in Skype For Business 2015 RRS feed

  • Question

  • Hi,

    Recently we got into an issue while provisioning Skype for Business to an organization. We have a web based portal that creates SIP domains and meet urls in the Skype for Business farm using some PS commands. The user under whose credential the PS commands are executed was a member of the "Enterprise Admins" group. However, the customer raised an alarm for this as this group is a special group and a member of this group has the full administrative rights on all the domains of the forest. The customer doesn't want to get this user account compromised in any way and as a precautionary measure wanted the user to get removed from the "Enterprise Admins" group.

    However, while trying to test the functionality by removing the user from the specified group in our local test environment we found the following error when tried to invoke the "Get-CSOUPermission" from the native Skype for Business Management Shell.

    Please provide us some suggestion on the granular permissions that has to be set for the user, so the PS commands can be invoked without making this user a member of the "Domain Admins" and/or "Enterprise Admins" group.

    It is to be noted that the user is a member of the "RTCUniversalServerAdmins", "RTCUniversalUserAdmins" and "CS-Administrators" group. We are using Skype for Business 2015.

    Thanks,

    Arnab

    Friday, September 20, 2019 5:12 PM

All replies

  • Hi Arnab_NITD,

    What is the detailed error? You may copy the error contents instead of a screenshot (which requires a verify).

    Where do you run the command, local/remote machine, remote powershell?

    As you said that the user is a member of the "RTCUniversalServerAdmins", "RTCUniversalUserAdmins" and "CS-Administrators" group, he already gets all admin permissions within the Skype for Business server.

    I suggest that you may do a test by remote PowerShell to see if it could work:

    New-PSSession -ConnectionUri https://Fe.domain.com/ocspowershell -Credential (Get-Credential)
    
    Import-PSSession -Session $session


    Best Regards,
    Shaw Lu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, September 23, 2019 6:06 AM
    Moderator
  • Hi Shaw,

    Regarding the execution of the PS commands, we are doing it locally, not remotely.

    We executed the command as mentioned by you. Following is the output after executing the command:

    PS C:\Users\wpa_s4b_high> $session=New-PSSession -ConnectionUri https://qawpas4bfe01.oncloud.wpa.local/ocspowershell -Cr
    edential (Get-Credential)

    cmdlet Get-Credential at command pipeline position 1
    Supply values for the following parameters:
    Credential
    PS C:\Users\wpa_s4b_high> Import-PSSession -Session $session
    WARNING: Proxy creation has been skipped for the following command: 'Test-CsClientAuth, Add-CsSlaDelegates,
    Approve-CsDeviceUpdateRule, Backup-CsPool, Clear-CsDeviceUpdateFile, Clear-CsDeviceUpdateLog,
    Clear-CsPersistentChatRoom, Debug-CsAddressBookReplication, Debug-CsDataConference, Debug-CsInterPoolReplication,
    Debug-CsIntraPoolReplication, Debug-CsLisConfiguration, Debug-CsStorageServiceFailures, Debug-CsUnifiedContactStore,
    Disable-CsHostingProvider, Disable-CsMeetingRoom, Disable-CsPublicProvider, Disable-CsUser, Enable-CsHostingProvider,
    Enable-CsMeetingRoom, Enable-CsPublicProvider, Enable-CsUser, Export-CsConfiguration, Export-CsLisConfiguration,
    Export-CsPersistentChatData, Export-CsUserData, Get-CsAccessEdgeConfiguration, Get-CsAdContact,
    Get-CsAdditionalInternalDomain, Get-CsAddressBookConfiguration, Get-CsAddressBookNormalizationConfiguration,
    Get-CsAddressBookNormalizationRule, Get-CsAdminRole, Get-CsAdminRoleAssignment, Get-CsAdPrincipal, Get-CsAdUser,
    Get-CsAllowedDomain, Get-CsAnalogDevice, Get-CsAnnouncement, Get-CsApplicationEndpoint, Get-CsArchivingConfiguration,
    Get-CsArchivingPolicy, Get-CsAudioTestServiceApplication, Get-CsAuthConfig, Get-CsAutodiscoverConfiguration,
    Get-CsAVEdgeConfiguration, Get-CsBackupServiceConfiguration, Get-CsBackupServiceStatus,
    Get-CsBandwidthPolicyServiceConfiguration, Get-CsBlockedDomain, Get-CsBusyOptions, Get-CsCallParkOrbit,
    Get-CsCallViaWorkPolicy, Get-CsCdrConfiguration, Get-CsCertificate, Get-CsClientAccessLicense, Get-CsClientCertificate,
     Get-CsClientPinInfo, Get-CsClientPolicy, Get-CsClientVersionConfiguration, Get-CsClientVersionPolicy,
    Get-CsClientVersionPolicyRule, Get-CsClsAgentStatus, Get-CsClsConfiguration, Get-CsClsRegion, Get-CsClsScenario,
    Get-CsClsSearchTerm, Get-CsClsSecurityGroup, Get-CsCommonAreaPhone, Get-CsComputer, Get-CsConferenceDirectory,
    Get-CsConferenceDisclaimer, Get-CsConferencingConfiguration, Get-CsConferencingPolicy,
    Get-CsConversationHistoryConfiguration, Get-CsCpsConfiguration, Get-CsDatabaseMirrorState,
    Get-CsDeviceUpdateConfiguration, Get-CsDeviceUpdateRule, Get-CsDiagnosticConfiguration,
    Get-CsDiagnosticHeaderConfiguration, Get-CsDialInConferencingAccessNumber, Get-CsDialInConferencingConfiguration,
    Get-CsDialInConferencingDtmfConfiguration, Get-CsDialInConferencingLanguageList, Get-CsDialPlan, Get-CsEffectivePolicy,
     Get-CsEnhancedEmergencyServiceDisclaimer, Get-CsExternalAccessPolicy, Get-CsExUmContact,
    Get-CsFileTransferFilterConfiguration, Get-CsFIPSConfiguration, Get-CsGroupPickupUserOrbit,
    Get-CsHealthMonitoringConfiguration, Get-CsHostedVoicemailPolicy, Get-CsHostingProvider,
    Get-CsHybridApplicationEndpoint, Get-CsImConfiguration, Get-CsImFilterConfiguration, Get-CsImTranslationConfiguration,
    Get-CsLisCivicAddress, Get-CsLisLocation, Get-CsLisPort, Get-CsLisServiceProvider, Get-CsLisSubnet, Get-CsLisSwitch,
    Get-CsLisWirelessAccessPoint, Get-CsLocationPolicy, Get-CsManagementConnection, Get-CsManagementStoreReplicationStatus,
     Get-CsMcxConfiguration, Get-CsMediaConfiguration, Get-CsMeetingConfiguration, Get-CsMeetingRoom, Get-CsMobilityPolicy,
     Get-CsNetworkBandwidthPolicyProfile, Get-CsNetworkConfiguration, Get-CsNetworkInterface,
    Get-CsNetworkInterRegionRoute, Get-CsNetworkInterSitePolicy, Get-CsNetworkRegion, Get-CsNetworkRegionLink,
    Get-CsNetworkSite, Get-CsNetworkSubnet, Get-CsOAuthConfiguration, Get-CsOAuthServer,
    Get-CsOutboundCallingNumberTranslationRule, Get-CsOutboundTranslationRule, Get-CsPartnerApplication,
    Get-CsPersistentChatAddin, Get-CsPersistentChatCategory, Get-CsPersistentChatComplianceConfiguration,
    Get-CsPersistentChatConfiguration, Get-CsPersistentChatEligiblePrincipal, Get-CsPersistentChatEndpoint,
    Get-CsPersistentChatPolicy, Get-CsPersistentChatRoom, Get-CsPersistentChatState, Get-CsPinPolicy,
    Get-CsPlatformServiceSettings, Get-CsPool, Get-CsPoolBackupRelationship, Get-CsPoolFabricState,
    Get-CsPresenceManagementState, Get-CsPresencePolicy, Get-CsPresenceProvider, Get-CsPrivacyConfiguration,
    Get-CsProxyConfiguration, Get-CsPstnUsage, Get-CsPublicProvider, Get-CsPushNotificationConfiguration,
    Get-CsQoEConfiguration, Get-CsRegistrarConfiguration, Get-CsReportingConfiguration, Get-CsRgsAgentGroup,
    Get-CsRgsConfiguration, Get-CsRgsHolidaySet, Get-CsRgsHoursOfBusiness, Get-CsRgsQueue, Get-CsRgsWorkflow,
    Get-CsRoutingConfiguration, Get-CsServerApplication, Get-CsService, Get-CsSimpleUrlConfiguration, Get-CsSipDomain,
    Get-CsSipResponseCodeTranslationRule, Get-CsSite, Get-CsSlaConfiguration, Get-CsStaticRoutingConfiguration,
    Get-CsStorageServiceConfiguration, Get-CsTeamsUpgradeConfiguration, Get-CsTeamsUpgradePolicy,
    Get-CsTelemetryConfiguration, Get-CsTestDevice, Get-CsThirdPartyVideoSystem, Get-CsThirdPartyVideoSystemPolicy,
    Get-CsTopology, Get-CsTrunk, Get-CsTrunkConfiguration, Get-CsTrustedApplication, Get-CsTrustedApplicationComputer,
    Get-CsTrustedApplicationEndpoint, Get-CsTrustedApplicationPool, Get-CsUCPhoneConfiguration, Get-CsUnassignedNumber,
    Get-CsUser, Get-CsUserAcp, Get-CsUserDatabaseState, Get-CsUserPoolInfo, Get-CsUserReplicatorConfiguration,
    Get-CsUserServicesConfiguration, Get-CsUserServicesPolicy, Get-CsVideoInteropServerConfiguration,
    Get-CsVideoInteropServerSyntheticTransactionConfiguration, Get-CsVideoTrunk, Get-CsVideoTrunkConfiguration,
    Get-CsVoiceConfiguration, Get-CsVoicemailReroutingConfiguration, Get-CsVoiceNormalizationRule, Get-CsVoicePolicy,
    Get-CsVoiceRoute, Get-CsVoiceRoutingPolicy, Get-CsVoiceTestConfiguration, Get-CsWatcherNodeConfiguration,
    Get-CsWebServiceConfiguration, Get-CsWindowsService, Get-CsXmppAllowedPartner, Get-CsXmppGatewayConfiguration,
    Grant-CsArchivingPolicy, Grant-CsCallViaWorkPolicy, Grant-CsClientPolicy, Grant-CsClientVersionPolicy,
    Grant-CsConferencingPolicy, Grant-CsDialPlan, Grant-CsExternalAccessPolicy, Grant-CsHostedVoicemailPolicy,
    Grant-CsLocationPolicy, Grant-CsMobilityPolicy, Grant-CsPersistentChatPolicy, Grant-CsPinPolicy,
    Grant-CsPresencePolicy, Grant-CsTeamsUpgradePolicy, Grant-CsThirdPartyVideoSystemPolicy, Grant-CsUserServicesPolicy,
    Grant-CsVoicePolicy, Grant-CsVoiceRoutingPolicy, Import-CSAnnouncementFile, Import-CsConfiguration,
    Import-CsLisConfiguration, Import-CsPersistentChatData, Import-CsRgsAudioFile, Import-CsUserData,
    Invoke-CsArchivingDatabasePurge, Invoke-CsBackupServiceSync, Invoke-CsCdrDatabasePurge, Invoke-CsDatabaseFailover,
    Invoke-CsManagementStoreReplication, Invoke-CsQoEDatabasePurge, Invoke-CsStorageServiceFlush, Invoke-CsUcsRollback,
    Lock-CsClientPin, Move-CsAnalogDevice, Move-CsApplicationEndpoint, Move-CsCommonAreaPhone, Move-CsConferenceDirectory,
    Move-CsExUmContact, Move-CsLegacyUser, Move-CsMeetingRoom, Move-CsRgsConfiguration, Move-CsThirdPartyVideoSystem,
    Move-CsUser, New-CsAdditionalInternalDomain, New-CsAddressBookConfiguration,
    New-CsAddressBookNormalizationConfiguration, New-CsAddressBookNormalizationRule, New-CsAdminRole, New-CsAllowedDomain,
    New-CsAnalogDevice, New-CsAnnouncement, New-CsArchivingConfiguration, New-CsArchivingPolicy,
    New-CsAutodiscoverConfiguration, New-CsAVEdgeConfiguration, New-CsBandwidthPolicyServiceConfiguration,
    New-CsBlockedDomain, New-CsCallParkOrbit, New-CsCallViaWorkPolicy, New-CsCdrConfiguration, New-CsClientPolicy,
    New-CsClientPolicyEntry, New-CsClientVersionConfiguration, New-CsClientVersionPolicy, New-CsClientVersionPolicyRule,
    New-CsClsConfiguration, New-CsClsProvider, New-CsClsRegion, New-CsClsScenario, New-CsClsSecurityGroup,
    New-CsCommonAreaPhone, New-CsConferenceDirectory, New-CsConferencingConfiguration, New-CsConferencingPolicy,
    New-CsCpsConfiguration, New-CsDeviceUpdateConfiguration, New-CsDiagnosticConfiguration,
    New-CsDiagnosticHeaderConfiguration, New-CsDiagnosticsFilter, New-CsDialInConferencingAccessNumber,
    New-CsDialInConferencingConfiguration, New-CsDialInConferencingDtmfConfiguration, New-CsDialPlan,
    New-CsEmergencyNumber, New-CsExtendedTest, New-CsExternalAccessPolicy, New-CsExUmContact,
    New-CsFileTransferFilterConfiguration, New-CsFIPSConfiguration, New-CsGroupPickupUserOrbit,
    New-CsHealthMonitoringConfiguration, New-CsHostedVoicemailPolicy, New-CsHostingProvider,
    New-CsHybridApplicationEndpoint, New-CsImConfiguration, New-CsImFilterConfiguration, New-CsImTranslationConfiguration,
    New-CsIssuedCertId, New-CsLocationPolicy, New-CsMcxConfiguration, New-CsMediaConfiguration, New-CsMeetingConfiguration,
     New-CsMobilityPolicy, New-CsNetworkBandwidthPolicyProfile, New-CsNetworkBWAlternatePath, New-CsNetworkBWPolicy,
    New-CsNetworkInterRegionRoute, New-CsNetworkInterSitePolicy, New-CsNetworkMediaBypassConfiguration,
    New-CsNetworkRegion, New-CsNetworkRegionLink, New-CsNetworkSite, New-CsNetworkSubnet, New-CsOAuthServer,
    New-CsOutboundCallingNumberTranslationRule, New-CsOutboundTranslationRule, New-CsPartnerApplication,
    New-CsPersistentChatAddin, New-CsPersistentChatCategory, New-CsPersistentChatComplianceConfiguration,
    New-CsPersistentChatConfiguration, New-CsPersistentChatEndpoint, New-CsPersistentChatPolicy, New-CsPersistentChatRoom,
    New-CsPinPolicy, New-CsPlatformServiceSettings, New-CsPresencePolicy, New-CsPresenceProvider,
    New-CsPrivacyConfiguration, New-CsProxyConfiguration, New-CsPublicProvider, New-CsPushNotificationConfiguration,
    New-CsQoEConfiguration, New-CsRegistrarConfiguration, New-CsReportingConfiguration, New-CsRgsAgentGroup,
    New-CsRgsAnswer, New-CsRgsCallAction, New-CsRgsHoliday, New-CsRgsHolidaySet, New-CsRgsHoursOfBusiness, New-CsRgsPrompt,
     New-CsRgsQuestion, New-CsRgsQueue, New-CsRgsTimeRange, New-CsRgsWorkflow, New-CsRoutingConfiguration,
    New-CsServerApplication, New-CsSimpleUrl, New-CsSimpleUrlConfiguration, New-CsSimpleUrlEntry, New-CsSipDomain,
    New-CsSipProxyCustom, New-CsSipProxyRealm, New-CsSipProxyTCP, New-CsSipProxyTLS, New-CsSipProxyTransport,
    New-CsSipProxyUseDefault, New-CsSipProxyUseDefaultCert, New-CsSipResponseCodeTranslationRule, New-CsStaticRoute,
    New-CsStaticRoutingConfiguration, New-CsStorageServiceConfiguration, New-CsTeamsUpgradeConfiguration,
    New-CsTeamsUpgradePolicy, New-CsTelemetryConfiguration, New-CsTestDevice, New-CsThirdPartyVideoSystem,
    New-CsThirdPartyVideoSystemPolicy, New-CsTrunkConfiguration, New-CsTrustedApplication,
    New-CsTrustedApplicationComputer, New-CsTrustedApplicationEndpoint, New-CsTrustedApplicationPool,
    New-CsUCPhoneConfiguration, New-CsUnassignedNumber, New-CsUserReplicatorConfiguration, New-CsUserServicesConfiguration,
     New-CsUserServicesPolicy, New-CsVideoInteropServerConfiguration,
    New-CsVideoInteropServerSyntheticTransactionConfiguration, New-CsVideoTrunkConfiguration,
    New-CsVoicemailReroutingConfiguration, New-CsVoiceNormalizationRule, New-CsVoicePolicy, New-CsVoiceRegex,
    New-CsVoiceRoute, New-CsVoiceRoutingPolicy, New-CsVoiceTestConfiguration, New-CsWatcherNodeConfiguration,
    New-CsWebLink, New-CsWebOrigin, New-CsWebServiceConfiguration, New-CsWebTrustedCACertificate, New-CsXmppAllowedPartner,
     Publish-CsLisConfiguration, Remove-CsAdditionalInternalDomain, Remove-CsAddressBookConfiguration,
    Remove-CsAddressBookNormalizationConfiguration, Remove-CsAddressBookNormalizationRule, Remove-CsAdminRole,
    Remove-CsAllowedDomain, Remove-CsAnalogDevice, Remove-CsAnnouncement, Remove-CsArchivingConfiguration,
    Remove-CsArchivingPolicy, Remove-CsAutodiscoverConfiguration, Remove-CsAVEdgeConfiguration,
    Remove-CsBackupServiceConfiguration, Remove-CsBandwidthPolicyServiceConfiguration, Remove-CsBlockedDomain,
    Remove-CsBusyOptions, Remove-CsCallParkOrbit, Remove-CsCallViaWorkPolicy, Remove-CsCdrConfiguration,
    Remove-CsClientPolicy, Remove-CsClientVersionConfiguration, Remove-CsClientVersionPolicy,
    Remove-CsClientVersionPolicyRule, Remove-CsClsConfiguration, Remove-CsClsRegion, Remove-CsClsScenario,
    Remove-CsClsSecurityGroup, Remove-CsCommonAreaPhone, Remove-CsConferenceDirectory, Remove-CsConferenceDisclaimer,
    Remove-CsConferencingConfiguration, Remove-CsConferencingPolicy, Remove-CsConversationHistoryConfiguration,
    Remove-CsCpsConfiguration, Remove-CsDeviceUpdateConfiguration, Remove-CsDeviceUpdateRule,
    Remove-CsDiagnosticConfiguration, Remove-CsDiagnosticHeaderConfiguration, Remove-CsDialInConferencingAccessNumber,
    Remove-CsDialInConferencingConfiguration, Remove-CsDialInConferencingDtmfConfiguration, Remove-CsDialPlan,
    Remove-CsEnhancedEmergencyServiceDisclaimer, Remove-CsExternalAccessPolicy, Remove-CsExUmContact,
    Remove-CsFileTransferFilterConfiguration, Remove-CsFIPSConfiguration, Remove-CsGroupPickupUserOrbit,
    Remove-CsHealthMonitoringConfiguration, Remove-CsHostedVoicemailPolicy, Remove-CsHostingProvider,
    Remove-CsHybridApplicationEndpoint, Remove-CsImConfiguration, Remove-CsImFilterConfiguration,
    Remove-CsImTranslationConfiguration, Remove-CsLisLocation, Remove-CsLisPort, Remove-CsLisServiceProvider,
    Remove-CsLisSubnet, Remove-CsLisSwitch, Remove-CsLisWirelessAccessPoint, Remove-CsLocationPolicy,
    Remove-CsManagementConnection, Remove-CsMcxConfiguration, Remove-CsMediaConfiguration, Remove-CsMeetingConfiguration,
    Remove-CsMobilityPolicy, Remove-CsNetworkBandwidthPolicyProfile, Remove-CsNetworkConfiguration,
    Remove-CsNetworkInterRegionRoute, Remove-CsNetworkInterSitePolicy, Remove-CsNetworkRegion, Remove-CsNetworkRegionLink,
    Remove-CsNetworkSite, Remove-CsNetworkSubnet, Remove-CsOAuthServer, Remove-CsOutboundCallingNumberTranslationRule,
    Remove-CsOutboundTranslationRule, Remove-CsPartnerApplication, Remove-CsPersistentChatAddin,
    Remove-CsPersistentChatCategory, Remove-CsPersistentChatComplianceConfiguration, Remove-CsPersistentChatConfiguration,
    Remove-CsPersistentChatEndpoint, Remove-CsPersistentChatMessage, Remove-CsPersistentChatPolicy,
    Remove-CsPersistentChatRoom, Remove-CsPinPolicy, Remove-CsPlatformServiceSettings, Remove-CsPresencePolicy,
    Remove-CsPresenceProvider, Remove-CsPrivacyConfiguration, Remove-CsProxyConfiguration, Remove-CsPublicProvider,
    Remove-CsPushNotificationConfiguration, Remove-CsQoEConfiguration, Remove-CsRegistrarConfiguration,
    Remove-CsReportingConfiguration, Remove-CsRgsAgentGroup, Remove-CsRgsHolidaySet, Remove-CsRgsHoursOfBusiness,
    Remove-CsRgsQueue, Remove-CsRgsWorkflow, Remove-CsRoutingConfiguration, Remove-CsServerApplication,
    Remove-CsSimpleUrlConfiguration, Remove-CsSipDomain, Remove-CsSipResponseCodeTranslationRule,
    Remove-CsSlaConfiguration, Remove-CsSlaDelegates, Remove-CsStaticRoutingConfiguration,
    Remove-CsStorageServiceConfiguration, Remove-CsTeamsUpgradeConfiguration, Remove-CsTeamsUpgradePolicy,
    Remove-CsTelemetryConfiguration, Remove-CsTestDevice, Remove-CsThirdPartyVideoSystem,
    Remove-CsThirdPartyVideoSystemPolicy, Remove-CsTrunkConfiguration, Remove-CsTrustedApplication,
    Remove-CsTrustedApplicationComputer, Remove-CsTrustedApplicationEndpoint, Remove-CsTrustedApplicationPool,
    Remove-CsUCPhoneConfiguration, Remove-CsUnassignedNumber, Remove-CsUserAcp, Remove-CsUserReplicatorConfiguration,
    Remove-CsUserServicesConfiguration, Remove-CsUserServicesPolicy, Remove-CsUserStoreBackupData,
    Remove-CsVideoInteropServerConfiguration, Remove-CsVideoInteropServerSyntheticTransactionConfiguration,
    Remove-CsVideoTrunkConfiguration, Remove-CsVoiceConfiguration, Remove-CsVoicemailReroutingConfiguration,
    Remove-CsVoiceNormalizationRule, Remove-CsVoicePolicy, Remove-CsVoiceRoute, Remove-CsVoiceRoutingPolicy,
    Remove-CsVoiceTestConfiguration, Remove-CsWatcherNodeConfiguration, Remove-CsWebServiceConfiguration,
    Remove-CsXmppAllowedPartner, Reset-CsDeviceUpdateRule, Reset-CsNotificationQueues, Restore-CsDeviceUpdateRule,
    Revoke-CsClientCertificate, Search-CsClsLogging, Set-CsAccessEdgeConfiguration, Set-CsAddressBookConfiguration,
    Set-CsAddressBookNormalizationConfiguration, Set-CsAddressBookNormalizationRule, Set-CsAdminRole, Set-CsAllowedDomain,
    Set-CsAnalogDevice, Set-CsAnnouncement, Set-CsApplicationServer, Set-CsArchivingConfiguration, Set-CsArchivingPolicy,
    Set-CsArchivingServer, Set-CsAudioTestServiceApplication, Set-CsAuthConfig, Set-CsAutodiscoverConfiguration,
    Set-CsAVEdgeConfiguration, Set-CsBackupServiceConfiguration, Set-CsBandwidthPolicyServiceConfiguration,
    Set-CsBlockedDomain, Set-CsBusyOptions, Set-CsCallParkOrbit, Set-CsCallParkServiceMusicOnHoldFile,
    Set-CsCallViaWorkPolicy, Set-CsCdrConfiguration, Set-CsClientPin, Set-CsClientPolicy, Set-CsClientVersionConfiguration,
     Set-CsClientVersionPolicy, Set-CsClientVersionPolicyRule, Set-CsClsConfiguration, Set-CsClsRegion, Set-CsClsScenario,
    Set-CsClsSearchTerm, Set-CsClsSecurityGroup, Set-CsCommonAreaPhone, Set-CsConferenceDisclaimer, Set-CsConferenceServer,
     Set-CsConferencingConfiguration, Set-CsConferencingPolicy, Set-CsConversationHistoryConfiguration,
    Set-CsCpsConfiguration, Set-CsDeviceUpdateConfiguration, Set-CsDiagnosticConfiguration,
    Set-CsDiagnosticHeaderConfiguration, Set-CsDialInConferencingAccessNumber, Set-CsDialInConferencingConfiguration,
    Set-CsDialInConferencingDtmfConfiguration, Set-CsDialPlan, Set-CsDirector, Set-CsEdgeServer,
    Set-CsEnhancedEmergencyServiceDisclaimer, Set-CsExternalAccessPolicy, Set-CsExUmContact,
    Set-CsFileTransferFilterConfiguration, Set-CsFIPSConfiguration, Set-CsGroupPickupUserOrbit,
    Set-CsHealthMonitoringConfiguration, Set-CsHostedVoicemailPolicy, Set-CsHostingProvider,
    Set-CsHybridApplicationEndpoint, Set-CsImConfiguration, Set-CsImFilterConfiguration, Set-CsImTranslationConfiguration,
    Set-CsLisLocation, Set-CsLisPort, Set-CsLisServiceProvider, Set-CsLisSubnet, Set-CsLisSwitch,
    Set-CsLisWirelessAccessPoint, Set-CsLocationPolicy, Set-CsManagementConnection, Set-CsManagementServer,
    Set-CsMcxConfiguration, Set-CsMediaConfiguration, Set-CsMediationServer, Set-CsMeetingConfiguration, Set-CsMeetingRoom,
     Set-CsMobilityPolicy, Set-CsMonitoringServer, Set-CsNetworkBandwidthPolicyProfile, Set-CsNetworkConfiguration,
    Set-CsNetworkInterRegionRoute, Set-CsNetworkInterSitePolicy, Set-CsNetworkRegion, Set-CsNetworkRegionLink,
    Set-CsNetworkSite, Set-CsNetworkSubnet, Set-CsOAuthConfiguration, Set-CsOAuthServer,
    Set-CsOutboundCallingNumberTranslationRule, Set-CsOutboundTranslationRule, Set-CsPartnerApplication,
    Set-CsPersistentChatActiveServer, Set-CsPersistentChatAddin, Set-CsPersistentChatCategory,
    Set-CsPersistentChatComplianceConfiguration, Set-CsPersistentChatConfiguration, Set-CsPersistentChatPolicy,
    Set-CsPersistentChatRoom, Set-CsPersistentChatState, Set-CsPinPolicy, Set-CsPlatformServiceSettings,
    Set-CsPresenceManagementState, Set-CsPresencePolicy, Set-CsPresenceProvider, Set-CsPrivacyConfiguration,
    Set-CsProxyConfiguration, Set-CsPstnGateway, Set-CsPstnUsage, Set-CsPublicProvider,
    Set-CsPushNotificationConfiguration, Set-CsQoEConfiguration, Set-CsRegistrar, Set-CsRegistrarConfiguration,
    Set-CsReportingConfiguration, Set-CsRgsAgentGroup, Set-CsRgsConfiguration, Set-CsRgsHolidaySet,
    Set-CsRgsHoursOfBusiness, Set-CsRgsQueue, Set-CsRgsWorkflow, Set-CsRoutingConfiguration, Set-CsServerApplication,
    Set-CsSimpleUrlConfiguration, Set-CsSipDomain, Set-CsSipResponseCodeTranslationRule, Set-CsSite,
    Set-CsSlaConfiguration, Set-CsStaticRoutingConfiguration, Set-CsStorageServiceConfiguration,
    Set-CsTeamsUpgradeConfiguration, Set-CsTeamsUpgradePolicy, Set-CsTelemetryConfiguration, Set-CsTestDevice,
    Set-CsThirdPartyVideoSystem, Set-CsThirdPartyVideoSystemPolicy, Set-CsTrunkConfiguration, Set-CsTrustedApplication,
    Set-CsTrustedApplicationEndpoint, Set-CsTrustedApplicationPool, Set-CsUCPhoneConfiguration, Set-CsUnassignedNumber,
    Set-CsUser, Set-CsUserAcp, Set-CsUserDatabaseState, Set-CsUserReplicatorConfiguration, Set-CsUserServer,
    Set-CsUserServicesConfiguration, Set-CsUserServicesPolicy, Set-CsVideoGateway, Set-CsVideoInteropServer,
    Set-CsVideoInteropServerConfiguration, Set-CsVideoInteropServerSyntheticTransactionConfiguration,
    Set-CsVideoTrunkConfiguration, Set-CsVoiceConfiguration, Set-CsVoicemailReroutingConfiguration,
    Set-CsVoiceNormalizationRule, Set-CsVoicePolicy, Set-CsVoiceRoute, Set-CsVoiceRoutingPolicy,
    Set-CsVoiceTestConfiguration, Set-CsWatcherNodeConfiguration, Set-CsWebServer, Set-CsWebServiceConfiguration,
    Set-CsXmppAllowedPartner, Set-CsXmppGatewayConfiguration, Show-CsClsLogging, Start-CsClsLogging,
    Start-CsWindowsService, Stop-CsClsLogging, Stop-CsWindowsService, Sync-CsClsLogging, Test-CsAddressBookService,
    Test-CsAddressBookWebQuery, Test-CsASConference, Test-CsAudioConferencingProvider, Test-CsAVConference,
    Test-CsAVEdgeConnectivity, Test-CsClientAuthentication, Test-CsDataConference, Test-CsDialInConferencing,
    Test-CsDialPlan, Test-CsExStorageConnectivity, Test-CsExStorageNotification, Test-CsExUMConnectivity,
    Test-CsExUMVoiceMail, Test-CsFederatedPartner, Test-CsGroupExpansion, Test-CsGroupIM, Test-CsIM,
    Test-CsInterTrunkRouting, Test-CsLisCivicAddress, Test-CsLisConfiguration, Test-CsLocationPolicy, Test-CsMcxConference,
     Test-CsMcxP2PIM, Test-CsMcxPushNotification, Test-CsP2PAV, Test-CsP2PVideoInteropServerSipTrunkAV,
    Test-CsPersistentChatMessage, Test-CsPhoneBootstrap, Test-CsPresence, Test-CsPstnOutboundCall,
    Test-CsPstnPeerToPeerCall, Test-CsRegistration, Test-CsTrunkConfiguration, Test-CsUcwaConference,
    Test-CsUnifiedContactStore, Test-CsVoiceNormalizationRule, Test-CsVoicePolicy, Test-CsVoiceRoute,
    Test-CsVoiceTestConfiguration, Test-CsVoiceUser, Test-CsWebApp, Test-CsWebAppAnonymous, Test-CsWebScheduler,
    Test-CsXmppIM, Unlock-CsClientPin, Unpublish-CsLisConfiguration, Update-CsAddressBook, Update-CsClsLogging,
    Update-CsUserData, Update-CsUserDatabase', because it would shadow an existing local command.  Use the AllowClobber
    parameter if you want to shadow existing local commands.
    Import-PSSession : No command proxies have been created, because all of the requested remote commands would shadow
    existing local commands.  Use the AllowClobber parameter if you want to shadow existing local commands.
    At line:1 char:1
    + Import-PSSession -Session $session
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : InvalidResult: (:) [Import-PSSession], ArgumentException
        + FullyQualifiedErrorId : ErrorNoCommandsImportedBecauseOfSkipping,Microsoft.PowerShell.Commands.ImportPSSessionCo
       mmand

    After this we executed the command

    Grant-CsOUPermission -OU "OU=SPTOU.sk,OU=OCS Tenants,DC=oncloud,DC=wpa,DC=local" -ObjectType u
    ser -DomainController "QAWPAAD01.oncloud.wpa.local" 

    and it gave us the same error.

    I'm providing the detailed log:

    <?xml version="1.0" encoding="utf-8"?>
    <CsMgmtLog Name="Grant-CsOUPermission">
      <Info Time="2019-09-23 07:08:05Z">This cmdlet is working on the local domain.</Info>
      <Action Time="2019-09-23 07:08:05Z">
        <Info Time="2019-09-23 07:08:05Z">Filter: (&amp;((ObjectCategory Equal person)(ObjectClass Equal user)(Sid Equal S-1-5-21-3391713881-3489470226-3500394428-1108)))</Info>
        <Info Time="2019-09-23 07:08:05Z">Found</Info>
        <Info Time="2019-09-23 07:08:05Z">User: CN=wpa_s4b_high,CN=Users,DC=oncloud,DC=wpa,DC=local</Info>
        <Info Time="2019-09-23 07:08:05Z">Group security identifier (SID): S-1-5-21-3391713881-3489470226-3500394428-512</Info>
        <Info Time="2019-09-23 07:08:05Z">HasToken: False</Info>
        <Info Time="2019-09-23 07:08:05Z">Root domain: oncloud.wpa.local.</Info>
        <Info Time="2019-09-23 07:08:05Z">Filter: (&amp;((ObjectCategory Equal person)(ObjectClass Equal user)(Sid Equal S-1-5-21-3391713881-3489470226-3500394428-1108)))</Info>
        <Info Time="2019-09-23 07:08:05Z">Found</Info>
        <Info Time="2019-09-23 07:08:05Z">User: CN=wpa_s4b_high,CN=Users,DC=oncloud,DC=wpa,DC=local</Info>
        <Info Time="2019-09-23 07:08:05Z">Group security identifier (SID): S-1-5-21-3391713881-3489470226-3500394428-519</Info>
        <Info Time="2019-09-23 07:08:05Z">HasToken: False</Info>
        <Info Time="2019-09-23 07:08:05Z">Filter: (&amp;((ObjectCategory Equal person)(ObjectClass Equal user)(Sid Equal S-1-5-21-3391713881-3489470226-3500394428-1108)))</Info>
        <Info Time="2019-09-23 07:08:05Z">Found</Info>
        <Info Time="2019-09-23 07:08:05Z">User: CN=wpa_s4b_high,CN=Users,DC=oncloud,DC=wpa,DC=local</Info>
        <Info Time="2019-09-23 07:08:05Z">Group security identifier (SID): S-1-5-21-3391713881-3489470226-3500394428-512</Info>
        <Info Time="2019-09-23 07:08:05Z">HasToken: False</Info>
        <Info Time="2019-09-23 07:08:05Z">Root domain: oncloud.wpa.local.</Info>
        <Info Time="2019-09-23 07:08:05Z">Filter: (&amp;((ObjectCategory Equal person)(ObjectClass Equal user)(Sid Equal S-1-5-21-3391713881-3489470226-3500394428-1108)))</Info>
        <Info Time="2019-09-23 07:08:05Z">Found</Info>
        <Info Time="2019-09-23 07:08:05Z">User: CN=wpa_s4b_high,CN=Users,DC=oncloud,DC=wpa,DC=local</Info>
        <Info Time="2019-09-23 07:08:05Z">Group security identifier (SID): S-1-5-21-3391713881-3489470226-3500394428-519</Info>
        <Info Time="2019-09-23 07:08:05Z">HasToken: False</Info>
        <Error Title="TaskFailed" Time="2019-09-23 07:08:05Z">Task execution failed.</Error>
        <Exception Type="DeploymentException" Time="2019-09-23 07:08:05Z" Message="The user is not a member of &quot;Domain Admins or Enterprise Admins&quot; group.">
          <StackTrace Time="2019-09-23 07:08:05Z">   at Microsoft.Rtc.Management.Deployment.Domain.ProcessOUPermissions(LcAction eAction, ObjectType objectType, String OU)
       at Microsoft.Rtc.Management.Deployment.Tasks.OUPermissionsGrantTask.Action()</StackTrace>
        </Exception>
        <Info Title="TaskFailed" Time="2019-09-23 07:08:05Z">OUPermissionsGrantTask execution failed on an unrecoverable error.</Info>
        <Info Time="2019-09-23 07:08:05Z">(0) LC_ACTION_CREATE</Info>
        <Info Time="2019-09-23 07:08:05Z">(1) User</Info>
        <Info Time="2019-09-23 07:08:05Z">(2) OU=SPTOU.sk,OU=OCS Tenants,DC=oncloud,DC=wpa,DC=local</Info>
        <Info Title="TaskFailedResolution" Time="2019-09-23 07:08:05Z">Consult exception information and previous errors for more information on how to resolve this error.</Info>
        <Complete Time="2019-09-23 07:08:05Z" />
      </Action>
      <Info Title="Command Status" Time="2019-09-23 07:08:05Z">Command processing is complete.</Info>
      <Info Title="Command Status" Time="2019-09-23 07:08:05Z">Command run is complete.</Info>
    </CsMgmtLog>

    Please let me know, the steps to resolve the issue as soon as possible, because we are stuck and the customer is really nagging.

    Thanks,

    Arnab

    Monday, September 23, 2019 7:43 AM
  • Hi Arnab_NITD,

    According the error:

    <Error Title="TaskFailed" Time="2019-09-23 07:08:05Z">Task execution failed.</Error>
        <Exception Type="DeploymentException" Time="2019-09-23 07:08:05Z" Message="The user is not a member of &quot;Domain Admins or Enterprise Admins&quot; group.">

    It is because the user is not a member of Domain Admins or Enterprise Admins group.

    As the command would change the OU permission in AD, I suggest you give the user the domain admins permission.

    Note: Please hide your private domain info in the post.


    Best Regards,
    Shaw Lu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, September 23, 2019 8:03 AM
    Moderator
  • Hi Shaw,

    The solution you provided in your reply is not accepted by the customer and that is what I mentioned in my first post. 

    Can you please let me know, if there is any alternate way to achieve the same result that can be obtained by executing the "Grant-CSOUPermission" command

    Thanks,

    Arnab


    • Edited by Arnab_NITD Monday, September 23, 2019 8:37 AM
    Monday, September 23, 2019 8:36 AM
  • Hi Arnab_NITD,

    Running “Grant-CsOuPermission” command on an OU will grant some groups permissions. Refer to this article: https://blogs.technet.microsoft.com/jenstr/2011/02/07/grant-cssetuppermission-and-grant-csoupermission/

    If you don’t use the command, you still need a domain admin account to grant the OU the permissions.

    I don’t find other command that could replace it.

    I'm not sure how often the command would be used, if only once, it could add the account to the domain admins group and run the command, then remove it after finishing.


    Best Regards,
    Shaw Lu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, September 23, 2019 9:18 AM
    Moderator
  • Hi,

    Do you have any further issue on this topic?

    Meanwhile, if there is no issue, please remember to mark helpful reply as answer to close the thread. Your action would be helpful to other users who encounter the same issue and read this thread.

    Thanks for your understanding.


    Best Regards,
    Shaw Lu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Friday, September 27, 2019 10:46 AM
    Moderator