diff --git a/CHANGELOG.md b/CHANGELOG.md index b1c5e898..8678acfa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Computer - Fix Get-ComputerDomain function to retrieve the computer NETBIOS domain name instead of the user. + - Remove deletion of computer object when PasswordPass and UnsecuredJoin options are used in DSC_Computer. + Fixes [Issue #446](https://github.com/dsccommunity/ComputerManagementDsc/issues/446). - `UserAccountControl` - Tests remove parameter type on `Assert-BoundParameter` mocks. diff --git a/source/DSCResources/DSC_Computer/DSC_Computer.psm1 b/source/DSCResources/DSC_Computer/DSC_Computer.psm1 index c08a58e5..598a8e20 100644 --- a/source/DSCResources/DSC_Computer/DSC_Computer.psm1 +++ b/source/DSCResources/DSC_Computer/DSC_Computer.psm1 @@ -262,13 +262,26 @@ function Set-TargetResource $addComputerParameters.Add("Server", $Server) } - # Check for existing computer objecst using ADSI without ActiveDirectory module + # Check for existing computer object using ADSI without ActiveDirectory module $computerObject = Get-ADSIComputer -Name $Name -DomainName $DomainName -Credential $Credential + # True when a pre-created computer object is required + $requiresPrecreated = ('JoinReadOnly' -in $Options) -or (('PasswordPass' -in $Options) -and ('UnsecuredJoin' -in $Options)) if ($computerObject) { - Remove-ADSIObject -Path $computerObject.Path -Credential $Credential - Write-Verbose -Message ($script:localizedData.DeletedExistingComputerObject -f $Name, $computerObject.Path) + if (-not $requiresPrecreated) + { + Remove-ADSIObject -Path $computerObject.Path -Credential $Credential + Write-Verbose -Message ($script:localizedData.DeletedExistingComputerObject -f $Name, $computerObject.Path) + } + } + else + { + if ($requiresPrecreated) + { + $errorMessage = $script:localizedData.ComputerObjectNotFound -f $Name, $DomainName + New-ObjectNotFoundException -Message $errorMessage + } } if (-not [System.String]::IsNullOrEmpty($Options)) diff --git a/source/DSCResources/DSC_Computer/en-US/DSC_Computer.strings.psd1 b/source/DSCResources/DSC_Computer/en-US/DSC_Computer.strings.psd1 index 22903a87..0ceb448c 100644 --- a/source/DSCResources/DSC_Computer/en-US/DSC_Computer.strings.psd1 +++ b/source/DSCResources/DSC_Computer/en-US/DSC_Computer.strings.psd1 @@ -17,6 +17,7 @@ ConvertFrom-StringData @' DomainNameAndWorkgroupNameError = Only DomainName or WorkGroupName can be specified at once. ComputerNotInDomainMessage = This machine is not a domain member. DeletedExistingComputerObject = Deleted existing computer object with name '{0}' at path '{1}'. + ComputerObjectNotFound = Computer object with name '{0}' not found in domain '{1}'. InvalidOptionPasswordPassUnsecuredJoin = Domain Join option 'PasswordPass' may not be specified if 'UnsecuredJoin' is specified. InvalidOptionCredentialUnsecuredJoinNullUsername = 'Credential' username must be null if 'UnsecuredJoin' is specified. '@