Tuesday, November 17, 2009

Windows PowerShell Execution Policy for 'AuthorizationManager check failed'

ERROR:
Command execution stopped because the shell variable "ErrorActionPreference" is set to Stop: Windows PowerShell snap-in "Quest.ActiveRoles.ADManagement" is loaded with the following warnings: Error loading the extended type data file: Quest.ActiveRoles.ADManagement, C:\Program Files\Quest Software\Management Shell for AD\Quest.ActiveRoles.ADManagement.Types.ps1xml : File skipped because of validation exception: "AuthorizationManager check failed.". There were errors in loading the format data file: Quest.ActiveRoles.ADManagement, C:\Program Files\Quest Software\Management Shell for AD\Quest.ActiveRoles.ADManagement.Format.ps1xml : File skipped because of validation exception: "AuthorizationManager check failed.".
At line:80 char:35 + if(-not $testsnapin){add-pssnapin <<<< -Name $SnapInName}


'AuthorizationManager check failed' means that initially we doesn't have permission to execute the Powershell Script to all users in the Sharepoint site because by default the execution policy is set to restricted.

To resolve the issue we need to got to 'ActiveRoles Management shell for Active Directory' command prompt and set execution policy to 'remotesigned' as shown below


C:\program files\Quest software\Management Shell for AD>set-Executionpolicy
cmdlet set-executionpolicy at command pipeline position 1
Supply values for the following parameters:
ExecutionPolicy: remotesigned
[PS] C:\Program Files\Quest Software\Management Shell for AD>

It will allows you to execute the script for all users who have permission to add the user in ADAM and for the SharePoint site.

WINDOWS POWERSHELL EXECUTION POLICIES:

The Windows PowerShell execution policies are as follows:

"Restricted" is the default policy.

Restricted

- Default execution policy.

- Permits individual commands, but will not run
scripts.

- Prevents running of all script files, including
formatting and configuration files (.ps1xml), module
script files (.psm1), and Windows PowerShell
profiles (.ps1).

AllSigned

- Scripts can run.

- Requires that all scripts and configuration files
be signed by a trusted publisher, including scripts
that you write on the local computer.

- Prompts you before running scripts from publishers
that you have not yet classified as trusted or
untrusted.

- Risks running unsigned scripts from sources other
than the Internet and signed, but malicious, scripts.

RemoteSigned

- Scripts can run.

- Requires a digital signature from a trusted
publisher on scripts and configuration files that
are downloaded from the Internet (including
e-mail and instant messaging programs).

- Does not require digital signatures on scripts that you have run
and that you have written on the local computer (not
downloaded from the Internet).

- Risks running signed, but malicious, scripts.

Unrestricted

- Unsigned scripts can run. (This risks running malicious
scripts.)

- Warns the user before running srcipts and configuration
files that are downloaded from the Internet.

Bypass

- Nothing is blocked and there are no warnings or
prompts.

- This execution policy is designed for configurations
in which a Windows PowerShell script is built in to a
a larger application or for configurations in which
Windows PowerShell is the foundation for a program
that has its own security model.

Undefined

- There is no execution policy set in the current scope.

- If the execution policy in all scopes is Undefined, the
effective execution policy is Restricted, which is the
default execution policy.

3 comments:

Anonymous said...

With the ExecutionPolicy set to RemoteSigned or Unrestricted, this error may also happen if the script was downloaded from the internet using IE, and IE has "Blocked" that file.

Right-click the file, select "Properties" click "Unblock". This wil resolve the "AuthorizationManager check failed" error

private key encryption said...

Exactly. I am also facing the same problem. I am getting the same error when I downloaded the script from the internet using internet explorer. I tried your given solution but didn't get anything in my hand..Can you please help me ? Am I missing something ?

digital certificate said...

Thanks for your advices. It will be sure helpful to set these values. I have bookmarked your site to transmit it to my colleagues.