-
Notifications
You must be signed in to change notification settings - Fork 81
Description
Problem description
the autocertbinding uses a scheduled task that uses
<RestartOnFailure>
<Interval>PT10M</Interval>
<Count>3</Count>
</RestartOnFailure>
This currently does not appear to be settable. This is important to have it retry a few times on failure if the cert isn't fully ready or there was a odd binding issue with one of the iis sites.
Other values that arn't currently supported include: (pulled from an exported task)
setting currently defaults to this
<Principals>
<Principal id="Author">
<Actions Context="Author">
but there should be an option to set to System also
<Principals>
<Principal id="System">
<Actions Context="System">
and
allowstartondemand
and this line may need correcting
AllowStartIfOnBatteries = -not $settings.DisallowStartIfOnBatteries
DisallowStartIfOnBatteries doesn't exist anywhere else maybe should be
AllowStartIfOnBatteries = $settings.allowStartIfOnBatteries
Verbose logs
no logs
DSC configuration
I'll post the working one, the above args would need to be added
$invokeParams = @{
Name = 'ScheduledTask'
ModuleName = 'ComputerManagementDsc'
Method = 'test'
Property = @{
'taskname' = 'IIS-AutoCertRebind';
'taskpath' = '\Microsoft\Windows\CertificateServicesClient';
'ensure' = 'present';
'description' = 'Automatically rebinds IIS to new certificates when issued';
'actionexecutable' = 'c:\windows\System32\inetsrv\appcmd.exe';
'scheduletype' = 'OnEvent';
'eventsubscription' = '<QueryList><Query Id="0" Path="Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"><Select Path="Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational">*[System[EventID=1001]]</Select></Query></QueryList>';
'runlevel' = 'Highest';
'user' = 'SYSTEM';
'actionarguments' = 'renew binding /oldcert:$(OldCertHash) /newcert:$(NewCertHash)';
'priority' = 7;
'startwhenavailable' = $false;
'runonlyifnetworkavailable' = $false;
'runonlyifidle' = $false;
'waketorun' = $false;
'hidden' = $false;
'EventValueQueries' = @{
"NewCertHash" = "Event/UserData/CertNotificationData/NewCertificateDetails/@Thumbprint";
"OldCertHash" = "Event/UserData/CertNotificationData/OldCertificateDetails/@Thumbprint"
}
}
}
Invoke-DscResource -Debug -Verbose @invokeParams
Suggested solution
I think it's just adding the new goodies.
Operating system the target node is running
win server 2016/2019
PowerShell version and build the target node is running
powershell 5.1
powershell 7 has an issue with Serialized XML is nested to deeply so I didn't use it for testing I think thats a different bug to be dealt with.
ComputerManagementDsc version
using 9.2.0 for this but the latest 10 didn't have it in its source code either so I don't think its fixed there either.
Ideal state
We could generate this in duplicate (this is what gets generated as a task if you export it if you enable autoiisbindings
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<URI>\Microsoft\Windows\CertificateServicesClient\IIS-AutoCertRebind</URI>
</RegistrationInfo>
<Triggers>
<EventTrigger>
<Enabled>true</Enabled>
<Subscription><QueryList><Query Id='0'><Select Path='Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational'>*[System[EventID=1001]]</Select></Query></QueryList></Subscription>
<ValueQueries>
<Value name="NewCertHash">Event/UserData/CertNotificationData/NewCertificateDetails/@Thumbprint</Value>
<Value name="OldCertHash">Event/UserData/CertNotificationData/OldCertificateDetails/@Thumbprint</Value>
</ValueQueries>
</EventTrigger>
</Triggers>
<Principals>
<Principal id="System">
<UserId>S-1-5-18</UserId>
<RunLevel>HighestAvailable</RunLevel>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>Queue</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
<Priority>7</Priority>
<RestartOnFailure>
<Interval>PT10M</Interval>
<Count>3</Count>
</RestartOnFailure>
</Settings>
<Actions Context="System">
<Exec>
<Command>%SystemRoot%\System32\inetsrv\appcmd.exe</Command>
<Arguments>renew binding /oldcert:$(OldCertHash) /newcert:$(NewCertHash)</Arguments>
</Exec>
</Actions>
</Task>