ConvertTo-DscObject fails on fresh Win11 install

[ricmestre]

@NikCharlebois @FabienTschanz For a couple of months now my work laptop has WinRM disabled by policy and I thought that the errors I was getting from DSCParser was due to this, nevertheless I'm able to run it without issues if I have an old M365DSC version installed instead of a recent one and use the exact same latest DSCParser 2.0.0.20.

To test this I fresh installed Win11 on a personal device, installed current M365DSC and dependencies, ran both winrm quickconfig and Enable-PSRemoting -Force and still get the same error messages that indicate PS remoting is not enabled which is not true. Note that I have several workloads in the same blueprint but this starts happening on Intune which has nested properties.

Any ideas of what might be causing this? I don't have this problem running it on MSHosted pipelines on Azure DevOps, only locally.

        IntuneAppConfigurationPolicy "IntuneAppConfigurationPolicy-IntuneAppConfigurationPolicy_1"
        {
            ApplicationId         = $IntuneApplicationId;
            Assignments           = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    deviceAndAppManagementAssignmentFilterType = 'none'
                    groupDisplayName = 'DummyGroupExclude'
                    dataType = '#microsoft.graph.exclusionGroupAssignmentTarget'
                    groupId = '053dc89a-be83-411a-bad3-909904b7239e'
                }
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    deviceAndAppManagementAssignmentFilterType = 'none'
                    groupDisplayName = 'DummyGroupInclude'
                    dataType = '#microsoft.graph.groupAssignmentTarget'
                    groupId = 'b0b8fd3f-af2a-453b-be57-80182d599f02'
                }
            );
            CertificateThumbprint = $IntuneCertThumbprint;
            CustomSettings        = @(
                MSFT_IntuneAppConfigurationPolicyCustomSetting{
                    name = 'com.microsoft.intune.mam.managedbrowser.AppProxyRedirection'
                    value = 'false'
                }
                MSFT_IntuneAppConfigurationPolicyCustomSetting{
                    name = 'com.microsoft.intune.mam.managedbrowser.AllowTransitionOnBlock'
                    value = 'true'
                }
                MSFT_IntuneAppConfigurationPolicyCustomSetting{
                    name = 'com.microsoft.outlook.Contacts.LocalSyncEnabled'
                    value = 'true'
                }
                MSFT_IntuneAppConfigurationPolicyCustomSetting{
                    name = 'com.microsoft.outlook.Contacts.LocalSyncEnabled.UserChangeAllowed'
                    value = 'true'
                }
            );
            DisplayName           = "IntuneAppConfigurationPolicy_1";
            Ensure                = "Present";
            Id                    = "44754094-9c69-4ee0-b587-d8af4efd4a7e";
            TenantId              = $OrganizationName;
        }

Missing type name after '['.
At line:4 char:50
+                                                 []::TryParse($subExpr ...
+                                                  ~
Missing type name after '['.
At C:\Program Files\WindowsPowerShell\Modules\DSCParser\2.0.0.20\Modules\DSCParser.psm1:400 char:29
+ ...                       Invoke-Expression -Command $scriptBlock | Out-N ...
+                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ParserError: (:) [Invoke-Expression], ParseException
    + FullyQualifiedErrorId : MissingTypename,Microsoft.PowerShell.Commands.InvokeExpressionCommand

[ricmestre]

Forgot to mention, the old M365DSC version I was referring to is 1.24.731.1 from last year, when using it with latest DSCParser 2.0.0.20 this issue doesn't happen which means it must have been some change(s) in M365DSC, but what and how can I fix this?

[ricmestre]

Just noticed that the module manifest still states it's version 2.0.0.16, this should read 2.0.0.20.

DSCParser/Modules/DSCParser/DSCParser.psd1

Line 15 in 2ae7031

ModuleVersion = '2.0.0.16'

[FabienTschanz]

I'll check in the next days on a new VM why it doesn't work. One thing we changed in the last releases was the ability to re-instantiate classes if the class version does not match what is defined in the mof file.

DSCParser/Modules/DSCParser/Modules/DSCParser.psm1

Lines 148 to 155 in 2ae7031

	$pattern = "\[ClassVersion\(""([^""]+)""\)\]\s*class $CIMInstanceName\b"
	if ($mofSchema -match $pattern) {
	$classVersion = [version]$matches[1]
	} else {
	$classVersion = [version]"1.0.0.0"
	}
	if ($null -eq $CIMClassObject -or [version]$CIMClassObject.CimClassQualifiers["ClassVersion"].Value -lt $classVersion)

Edit: After rethinking, we only recently started to increase the class version of the schema.mof files in their definition, so the DSCParser needs to reinstantiate them for the latest properties to be available. If you use an old version and you already used them at least once before, no update is necessary. That's why it fails with the new version (because of the class version updates, requiring reinstantiating the classes).

[ricmestre]

This is a fresh install so I never used the classes before :)

Also noticed the same problem on another VM on a different device, but like I said the problem only happens if I use a recent M365DSC version, if I revert back to an old one combined with the latest DSCParser version then I don't have the problem, $classVersion in this case will always be "1.0.0.0" because the schema versions were not being increased at that time.

[ricmestre]

Errrrr, I'm starting to mix different issues here, I look like an hallucinating LLM sorry about that.

So I tried to run ConvertTo-DscObject again in 2 devices:

• Company laptop, been running M365DSC on this one for years but WinRM/PSRemoting now is disabled by policy:

• • M365DSC 1.24.731.1 + DSCParser 2.0.0.20 -> Works correctly
• • M365DSC 1.25.1112.1 + DSCParser 2.0.0.20 -> Works but it got exponentially slower, like several minutes per each resource that has nested properties

• Personal device, fresh Win11 install:

• • M365DSC 1.24.731.1 + DSCParser 2.0.0.20 -> Fails
• • M365DSC 1.25.1112.1 + DSCParser 2.0.0.20 -> Fails

So by the looks of it the problem is not actually related with the $classVersion, I put a debug message and it seems to find correct versions of the classes without issues, something else is causing this.

[FabienTschanz]

I just discovered that the current version 2.0.0.20 on the PowerShell gallery does NOT contain the effective file contents that it should, it seems to still be on 2.0.0.16, even if says that 2.0.0.20 is on the gallery. I asked Nik to fix this. Hopefully shortly.

[ricmestre]

Now that makes more sense, I actually didn't look too much into it and just assumed it was a version glitch but that the code was updated, with the new version 2.0.0.21 just released now on my work laptop as soon as the first Intune gets processed then DSCParser throws an exception which is to be expected since WinRM is disabled by policy.

With that being said it's also highly likely that now it works on that other Win11 device, I'll test that tomorrow ASAP and if it works I'll close this issue.

[ricmestre]

@FabienTschanz Geez my personal Win11 got orders of magnitude slower somehow so it took me a while to test this, but sure enough with latest version now it works there and fails on my work laptop (to be expected due to blocked WinRM).

Thank you for the heads up to Nik to update this!

[FabienTschanz]

Awesome, thank you for checking! 🚀