Does Automox Use x86 powershell?

TJ_Coppola

April 5, 2022 at 6:03 pm UTC

#powershell#LAPS#Local Admin Password Solution

I’m attempting to script a LAPS installation which requires the creation of a local account. When I test the powershell script on my local machine everything works great. When I tried to run it through Automox I get an error.

powershell34 lines

Get-LocalGroupMember : The term 'Get-LocalGroupMember' is not recognized as 
the name of a cmdlet, function, script file, or operable program. Check the 
spelling of the name, or if a path was included, verify that the path is 
correct and try again.
At C:\ProgramData\amagent\execDir691746467\execcmd943937958.ps1:3 char:15
+ $isingorup = (Get-LocalGroupMember $group).Name -Contains $user
+               ~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-LocalGroupMember:String) [] 
   , CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

New-LocalUser : The term 'New-LocalUser' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the 
name, or if a path was included, verify that the path is correct and try again.
At C:\ProgramData\amagent\execDir691746467\execcmd943937958.ps1:6 char:1
+ New-LocalUser "CTPAdmin" -Password $password -Description "Local Admi ...
+ ~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (New-LocalUser:String) [], Comma 
   ndNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

Add-LocalGroupMember : The term 'Add-LocalGroupMember' is not recognized as 
the name of a cmdlet, function, script file, or operable program. Check the 
spelling of the name, or if a path was included, verify that the path is 
correct and try again.
At C:\ProgramData\amagent\execDir691746467\execcmd943937958.ps1:7 char:1
+ Add-LocalGroupMember -Group $group -Member "CTPAdmin"
+ ~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Add-LocalGroupMember:String) [] 
   , CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException


COMMAND TIMED OUT.

When looking up the possible cause of this error I found that the Microsoft.Powershell.LocalAccounts module is only available with powershell x64.

Does Automox use x86 powershell and if so is a x64 powershell available?

This discussion is archived and closed to replies. Continue it in the Automox Community Slack.

Discuss on Slack

Replies (3)

jack.smithApril 6, 2022

Sure does. There is a way to execute 64-bit PowerShell. To do that, checkout https://support.automox.com/help/enforce-windows-registry-settings-worklet just under the “64-Bit Registry Workaround” section or see the 64-bit example below.

Before that, the net commands still work for x86 powershell

3 lines

net user ITAdmin $password /ADD /Y

net localgroup Administrators ITAdmin /ADD

Here is a 64-bit example

powershell66 lines

$scriptblock = {

    ############# EDIT HERE ############
    $account = "ITAdmin"
    $description = "IT local admin account"
    ####################################

    # Function to generate Random Passwords
    function New-RandomPassword {
        param(
            [Parameter()]
            [int]$MinimumPasswordLength = 18,
            [Parameter()]
            [int]$MaximumPasswordLength = 29,
            [Parameter()]
            [int]$NumberOfAlphaNumericCharacters = 9,
            [Parameter()]
            [switch]$ConvertToSecureString
        )
        Add-Type -AssemblyName 'System.Web'
        $length = Get-Random -Minimum $MinimumPasswordLength -Maximum $MaximumPasswordLength
        $password = [System.Web.Security.Membership]::GeneratePassword($length,$NumberOfAlphaNumericCharacters)
        if ($ConvertToSecureString.IsPresent) {
            ConvertTo-SecureString -String $password -AsPlainText -Force
        } else {
            $password
        }
    }

    # Generate random password
    $pw = ConvertTo-SecureString "$(New-RandomPassword)" -AsPlainText -Force

    # Create User Account and Add to Administrator Group
    New-LocalUser $account -Password $pw -FullName $account -Description $description -verbose
    Add-LocalGroupMember -Group Administrators -Member $account -verbose

    # Validate Account was created
    $ac = Get-LocalUser $account
    IF($ac){
        $grp = Get-LocalGroupMember Administrators
        IF($grp){
            # Account exists and is a local admin
            return 0
        }else{
            # Account exists but is not a local admin
            return 2
        }
    }else{
        # Account doesn't exist return 1
        return 1
    }
}

# Run scriptblock in 64-bit powershell
$64bit = & "$env:SystemRoot\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -Command $scriptblock

$out = switch ($64bit)
{
    0 {"Succesfully created $account and added to local admin group"}
    1 {"Failed to create $account"}
    2 {"Succesfully created $account and failed to add to local admin group"}
    Default {"$64bit"}
}

Write-Output $out
Exit $64bit

shameless plug... you should also check out

TJ_CoppolaApril 6, 2022

Thank you so much! This is perfect.

TJ_CoppolaApril 12, 2022

Wouldn’t the following line require more specificity if it’s to validate that the account is within the admin group? It looks like it only checks if there are any administrators at all.

1 line

$grp = Get-LocalGroupMember Administrators

Does this change improve the effectiveness?

powershell1 line

$grp = Get-LocalGroupMember Administrators | Where-Object {$_.name -like "*$Account*"}

Back to all discussions