New Question
0

If I add LocalScripts, Clousebase-init resets my Administrator account password

asked 2021-09-16 17:51:45 +0200

s-cappa gravatar image

Hi! I'm using cloudbase-init in this environment:

  • Windows Server 2016 with all available updates installed
  • sysprepped Windows Server 2016 with sysprep.exe /generalize /oobe /shutdown /unattend:Unattend.xml
  • Network with static ipv4 address
  • Cloudbase-init 1.1.2 stable x64
  • NoCloudConfigDrive (iso image called cidata)
  • power shell localscripts are in a dedicated folder of cidata iso image (D:\localscripts)

These are the steps executed automatically:

  1. Windows server 2016 starts asking to change Administrator password
  2. After a couple of minutes it reboots automatically (thanks to delayed start). Now I can login with both "Administrator" and "Boris" accounts with the passwords defined in user-data
  3. After a couple of minutes it reboots again (when It runs local scripts)
  4. Now I cannot login anymore as Administrator, because password is changed <---- WHY????

I'm having lot of troubles posting in this text editor, so I added a link at the end of the post to download all files.

These are my Configuration files: - config-init.conf

[DEFAULT]
username=Administrator
groups=Administrators
inject_user_password=true
first_logon_behaviour=no
config_drive_raw_hhd=true
config_drive_cdrom=true
config_drive_vfat=true
bsdtar_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\bsdtar.exe
mtools_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\
verbose=true
debug=true
logdir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\
logfile=cloudbase-init.log
default_log_levels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN
logging_serial_port_settings=
mtu_use_dhcp_config=false
ntp_use_dhcp_config=false
local_scripts_path=D:\localscripts\
metadata_services=cloudbaseinit.metadata.services.nocloudservice.NoCloudConfigDriveService
plugins=cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin,
      cloudbaseinit.plugins.windows.createuser.CreateUserPlugin,
      cloudbaseinit.plugins.common.networkconfig.NetworkConfigPlugin,
      cloudbaseinit.plugins.common.userdata.UserDataPlugin,
      cloudbaseinit.plugins.common.setuserpassword.SetUserPasswordPlugin,
      cloudbaseinit.plugins.common.localscripts.LocalScriptsPlugin
allow_reboot=true
stop_service_on_exit=false
check_latest_version=false
  • config-init-unattend.conf

    [DEFAULT] injectuserpassword=false firstlogonbehaviour=no configdriverawhhd=true configdrivecdrom=true configdrivevfat=true bsdtarpath=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\bsdtar.exe mtoolspath=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\ verbose=true debug=true logdir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\ logfile=cloudbase-init-unattend.log defaultloglevels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN loggingserialportsettings= mtuusedhcpconfig=false ntpusedhcpconfig=false localscriptspath=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\ metadataservices= plugins= allowreboot=true stopserviceonexit=false checklatest_version=false

  • Unattend.xml (no changes, I'm using the default file provided by Cloudbase-init)

File in cidata iso image:

  • user-data:

    cloud-config

    hostname: windows-server users:

    • name: Administrator passwd: Password1! primary_group: Administrators
    • name: Boris passwd: Password1! primary_group: Users
  • meta-data:

    instance-id: b4883f9ee294 network-interfaces: | auto Ethernet iface Ethernet inet static address 192.168.100.30 network 192.168.100.0 netmask 255.255.255.0 broadcast 192.168.100.255 gateway 192.168.100.234 hwaddress ether 02:00:00:84:fa:04 dns-nameservers 1.1.1.1

  • localscripts/powershell.ps1

    ps1_sysnative

    // do something only to try localscripts: Get-CimClass -ClassName Win32_*System
    exit 1001

I also configure Cloudbase-init with delayed-auto in this way:

sc.exe config "cloudbase-init" start= delayed-auto

Here you can download my .conf and .log files ... (more)

edit retag flag offensive close merge delete

2 answers

Sort by » oldest newest most voted
0

answered 2021-09-21 13:02:05 +0200

avladu gravatar image

Hello,

cloud-config userdata behaves very similar to another instance of cloud-init (or cloudbase-init), and mixing metadata information and cloud-config information that applies to the same feature can lead to unwanted behaviours like the ones you have in this case.

cloudbaseinit.plugins.windows.createuser.CreateUserPlugin is being run after the cloud-config Administrator user / password configuration from the cloud-config data, leading to a password reset.

I suggest in this case to remove the cloudbaseinit.plugins.windows.createuser.CreateUserPlugin and cloudbaseinit.plugins.common.setuserpassword.SetUserPasswordPlugin from the enabled plugins, so that cloud-config data gets applied.

As an overall suggestion, I suggest to use the cloud-config to only specialize the instance with features that the base metadata does not have. If you choose this recomended route, cloud-config should only create the Boris user, and the Administrator creation/password and the hostname configuration to be moved in the metadata.

Thank you,
Adrian Vladu

edit flag offensive delete link more

Comments

thank you, now it's working

s-cappa gravatar images-cappa ( 2021-09-22 10:12:57 +0200 )edit

What do you mean exactly for "cloud-config information"? Are you talking about "cloud-config" conf files or "user-data"?

Probably I missed something, because I don't understand why you suggested to define Boris account and Administrator account in different places. Thank you.

s-cappa gravatar images-cappa ( 2021-09-22 12:53:18 +0200 )edit
0

answered 2021-09-20 10:47:12 +0200

s-cappa gravatar image

If you missed my log files, I added a link at the end of the initial post. However, to be sure I repost the download link here

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-09-16 17:51:45 +0200

Seen: 1,970 times

Last updated: Sep 21 '21