PowerShell provider MSFT_ScriptResource failed to execute Test-TargetResource functionality with error message: The expression after '&' in a pipeline element produced an object that was not valid. It must result in a command name, a script block, or a C

Question

I found this article, and used it, and it seems as though my script resource node items are being properly expanded, and honestly I think it passes through being loaded up, but then when I go to start it, it fails. so let me put up some links with code and
error messages for you all.
http://social.technet.microsoft.com/Forums/exchange/en-US/2eb97d67-f1fb-4857-8840-de9c4cb9cae0/dsc-configuration-data-for-script-resources
Ok, so here is my configuration. The idea is that I need some specific permissions set on a specific registry key on my sql servers. This is so I can do the SQL LowPriv monitoring. I'm just setting one key right now, premise is once this is working I can
then duplicate that for the remaining keys.
https://gist.github.com/jeffpatton1971/1bfb19a06782f0975f6e
When I paste that into the prompt it appears to be perfectly happy
https://gist.github.com/jeffpatton1971/3aeb568130988a460738
In fact, the resulting MOF file looks ok to me
https://gist.github.com/jeffpatton1971/a94858f0c1e9e5612f90
When I attempt to start the configuration on my local machine, which has the key this is what I get
https://gist.github.com/jeffpatton1971/82da888bb7aac31ef4ad
lol...well so it's a different error now, I removed a credential param that I wasn't using, so now i'm left with an & that I can't seem to find anywhere... at any rate...so now my issue has become where is the bad &?I'm going back to the internets
to see if there is something akin to this error, and i'm open to any questions the most pressing one is why are my scriptblocks all smooshed together? well, early on I was wondering if random whitespace and extra characters were mucking up the waters. I may
actually dial down the script and see if I can add things until I get the error as well.
Jeffrey S. Patton Jeffrey S. Patton Systems Specialist, Enterprise Systems University of Kansas 1001 Sunnyside Ave. Lawrence, KS. 66045 [phone] | http://patton-tech.com

Answer 1

I looked at the first link, and it looks like you might be missing quotes around the $Node.ActionAccount part of the comparison, which would cause the script block creation to fail. Maybe change the sections that look like this:
Where-Object {$_.IdentityReference -eq $Node.ActionAccount}
to this:
Where-Object {$_.IdentityReference -eq '$Node.ActionAccount'}
If you're looking to do permission changes with DSC, I'm actually looking for testers for my
PowerShellAccessControl module. The 3.0 beta has two DSC resoruces: cAccessControlEntry (lets you make sure an ACE is present or absent) and cSecurityDescriptor (lets you specify an SDDL string for an object). The current cSecurityDescriptor is going to
be called cSecurityDescriptorSddl in a future release, and a new cSecurityDescriptor is going to be added that lets you control the different sections without using SDDL. If you were to use it, I think you could change your configuration to the following (at
least for the permission part):
Configuration SQLLowPrivRegistry {
param(
[string[]] $ComputerName = "localhost"
Import-DscResource -Module PowerShellAccessControl
Node $ComputerName {
cAccessControlEntry TopLevelActionAccountPermissions {
Ensure = "Present"
Path = "HKLM:\Software\Microsoft\Microsoft SQL Server\"
ObjectType = "RegistryKey"
AceType = "AccessAllowed"
AccessMask = ([System.Security.AccessControl.RegistryRights]::ReadKey)
Principal = "DOMAIN\SqlDefaultAction_sa"
What you're doing should work just fine, so I'm not saying you need to use mine. If you do get a chance to look at it, though, please let me know what you think (or if it even works). There are two scripts in the examples folder of the module that demo more
with the two resources (hopefully that will do until I finalize the documentation).