Error with Remote Powershell

[Marius Salay]

Hi there,

we wrote a script to handle (create/modify/delete) RDP connections for newly deployed servers using Ansible.
The script works fine when ran within a user session/GUI, but any attempt to use it remote fails with

Code:

Showing a modal dialog box or form when the application is not running in UserInteractive mode is not a valid
operation. Specify the ServiceNotification or DefaultDesktopOnly style to display a notification from a service
application.

It is architecture independent and seems to be version independent as well (I´ve tried the latest version and last of 2019).
We tried envoke-command and several *PSSession commands with no luck.

It seems that a message box is called from anywhere within the powershell module (which cannot be displayed remote).

Any hints?

Regards
Marius

[DevOma]

If you run it in GUI is there any dialog? It should not display any dialogs...

How do you call / use the script remotely? Is ASG-RD installed on the remote machine? Are you executing the script in the program files dir of ASGRD?

[rsturm]

If you run it in GUI is there any dialog? It should not display any dialogs...

How do you call / use the script remotely? Is ASG-RD installed on the remote machine? Are you executing the script in the program files dir of ASGRD?

To add some confusion to the topic, I'll answer on Marius' behalf (I am his colleague, we both worked on that script)

ASG is installed on the remote machine.
There are no (visible) dialogs when the script is invoked in a local powershell session and the user is correct.

The code in question:

Code:

$workingdir = "C:\Program Files\ASG-Remote Desktop 2020 (X64)\"
Set-Location $workingdir
[Environment]::CurrentDirectory = Get-Location -PSProvider FileSystem
$path = $workingdir + "ASGRD-PSAPI.dll"
Add-Type -path $path
[reflection.assembly]::LoadFrom($path) | Import-Module
Connect-RDEnvironment -Environment env -Username the.user -Domain example.com -Password REDACTED
Get-RDEnvironmentConnected

As you can see, we run the command from ASG's program directory.

When the code is executed via PSRemoting (either with Invoke-Command or Enter-PSSession) it fails when it tries to show modal dialogs.

Code:

> Connect-RDEnvironment -Environment env -Alltheotherparameters
Showing a modal dialog box or form when the application is not running in UserInteractive mode is not a valid
operation. Specify the ServiceNotification or DefaultDesktopOnly style to display a notification from a service
application.
    + CategoryInfo          : NotSpecified: (:) [Connect-RDEnvironment], InvalidOperationException
    + FullyQualifiedErrorId : System.InvalidOperationException,CloudAdminPSModule.CmdLetEnvironment+RDBaseItemChildsGe
   tCommand

The behaviour is the same when -PassTrough is used instead of Username+Password.

[DevOma]

We will have a look on this - never tried to use it via remote session

[DevOma]

I tried to use it as remote powershell session - and got a lot of errors... the API was never designed for remote sessions...

Why do you need to execute it on a remote session/server? It will be no difference on which computer it is executed - or do you want to read/write data from a local data source on a remote machine?

[rsturm]

Hey Oliver, thanks for looking into this.

We need to execute it remotely because we want to automate the creation of entries in ASG-RD during the deployment of new machines.
As we use Ansible for the deployment, remote execution via WinRM is the only way to go.

We even tried to put all the code into a script to execute it via Invoke-command... failed with the same errors.

It seems that the issue is related to the headless mode of our user session which doesn't support modal dialogs.

[DevOma]

Why don't you use a database instead of inserting some items into each local environment? I think something goes wrong in "internal login process" - the login user is impersonated and perhaps that's not working in a remote session - must try a little bit more, perhaps try to use other login options... Or perhaps you can just export your "initial settings" and import it via command line?

[Marius Salay]

We use a central database.
When a new server ist deployed, it needs to be created as a connection in ASGRD manually at the moment.
In future, the script should be called out of the linux-based deployment process to automate the creation.

[DevOma]

Ok - I think I found the reason - the remote session is not running under a known Windows-Account - so connection to database as denied and I think there was a modal dialog popping up...

If you want to run the API via remote call - you need to connect to a Database environment that uses a database user / Password for accessing the daabase - Integrated will not work (error: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.)

I have made some changes in my code to get the results - so I will verify where the dialog is shown and try to write back a warning message instead with the next version - but I think it should run also with current version if you check/change your database environment settings!

[rsturm]

Yes and no, the remote sessions are kind of incomplete, we had similar pass-through-authentication issues with other programs like robocopy and such, that's a known issue with psremoting and the very reason why we don't use the -PassThrough parameter with Connect-RDEnvironment and pass the credentials with the other parameters.

If I understand it correctly, ASG doesn't use these credentials for the database connection and tries to use the "broken" Environment?

[DevOma]

There are 2 authentications in ASGRD - once the user that you use to login into ASGRD - every user gets an own UserID and this is used to evaulate your internal permissions in ASGRD.

Second one is the database connection - you can use "Integrated Auth" so the WindowsUser is authenticated against your SQL instance! But you also can specify an internal sql user for the database connection! Just open EnvironmentManager => New connection to an existing database - in page "Database Access" you can choose how to authenticate - this is used for the ConnectionString!

[rsturm]

Thank you, that explains a lot... as a domain user doesn't work in this case, we'll try as soon as our DBA creates a sql-internal user for our tests.

A suggestion for your next version: if the api-connect is done with credentials, use those to connect to the database.

[DevOma]

We will try that...

[DevOma]

I have tested a bit with Remote-Powershell - and if I run the remote powershell session as a user it works great - you just have to enter the password for a credential (don't know if that can be also scripted) - my script looks like this

Code:

$cred = Get-Credential -Credential myDomain\myUser

$remotesession = New-PSSession -Name remotesession -ComputerName myVM -Credential $cred

Enter-PSSession $remotesession

$workingdir = "C:\Program Files\ASG-Remote Desktop 2022 (X64)\"

Set-Location $workingdir
[Environment]::CurrentDirectory = Get-Location -PSProvider FileSystem

$path = $workingdir + "ASGRD-PSAPI.dll"

Add-Type -path $path
[reflection.assembly]::LoadFrom($path) | Import-Module

Connect-RDEnvironment -Environment TestEnv -PassThrough

Get-RDEnvironmentConnected