使用以下 DSC 配置（仅资源部分的片段，删除 SO 的前导码、诊断和 Start-DscConfiguration 部分）：
Package TFSServer2013 {
Name = "Microsoft Team Foundation Server 2013 Update 3 (x64)"
Path = '$InstallerPath\Team Foundation Server 2013\tfs_server.exe'
Arguments = "/quiet"
Credential = $Credential
Ensure = "Present"
ProductID = "B516BA7C-3C20-3FCC-B130-B42058ABF87A"
}
File TFSUserFile {
DestinationPath = "$Env:TEMP\TFSConfig\TfsUserName.clixml"
Attributes = "Hidden"
SourcePath = $TFSUsernameFile
Ensure = "Present"
Force = $true
Credential = $Credential
Type = "File"
MatchSource = $true
}
File TFSPasswordFile {
DestinationPath = "$Env:TEMP\TFSConfig\TfsUserPassword.clixml"
Attributes = "Hidden"
SourcePath = $TFSUserPasswordFile
Ensure = "Present"
Force = $true
Credential = $Credential
Type = "File"
MatchSource = $true
}
File TfsBuildAgentConfigureScript {
DestinationPath = "$LocalInstallerPath\PowerShell\Configure-TfsBuildService.ps1"
SourcePath = "$POSModulePath\Configure-TfsBuildService.ps1"
Ensure = "Present"
Force = $true
Credential = $Credential
Type = "File"
MatchSource = $true
}
Script TFSConfigure {
SetScript = "
. C:\BuildAgent\Installers\PowerShell\Configure-TfsBuildService.ps1
Setup-TfsBuildService -ConfigIniFile 'C:\BuildAgent\Logs\TfsConfig.ini' -TfsBuildControllerName 'TFSMASTER' -TfsServiceUri 'http://mytfsservice:8080/tfs/My_Collection' -TfsUsernameClixml ""`$Env:TEMP\TFSConfig\TfsUserName.clixml"" -LogFilesPath 'C:\BuildAgent\Logs' -TfsUserPasswordClixml ""`$Env:TEMP\TFSConfig\TfsUserPassword.clixml""
if (`$false) { Remove-Item -Force -Path ""$Env:TEMP\TFSConfig\TfsUserPassword.clixml"" }
"
TestScript = "
New-EventLog -LogName 'Windows Powershell' -Source DSC -ErrorAction SilentlyContinue
Write-EventLog -LogName 'Windows PowerShell' -Source DSC -EntryType Information -EventId 1 -Message ""Testing if TFS build service is up and running.""
`$srv = Get-WmiObject -Class Win32_Service | Where-Object -FilterScript { (`$PSItem.Name -ne `$null) -and (`$PSItem.Name.Equals(""TFSBuildServiceHost.2013"")) }
return (`$srv -ne `$null)
"
GetScript = "
New-EventLog -LogName 'Windows Powershell' -Source DSC -ErrorAction SilentlyContinue
`$ensure='Absent'
if (Test-Path 'C:\BuildAgent\Logs\TfsConfig.ini' -ErrorAction Ignore) { `$ensure = 'Present' }
Write-EventLog -LogName 'Windows PowerShell' -Source DSC -EntryType Information -EventId 1 -Message ""TFSConfigure GetScript (C:\BuildAgent\Logs\TfsConfig.ini): Ensure=`$ensure""
@{Ensure=`$ensure}
"
Credential = $Credential
DependsOn = "[File]TFSPasswordFile","[File]TFSUserFile","[Package]TFSServer2013","[File]TfsBuildAgentConfigureScript"
}
我在无人值守模式下配置 TFS 构建服务的脚本如下（出于 SO 的目的，我已经删除了日志记录、错误检查和诊断）：
Function Setup-TfsBuildService
{
Param(
[Parameter(Mandatory=$true)]
[string]
$ConfigIniFile,
[Parameter(Mandatory=$true)]
[string]
$TfsBuildControllerName,
[Parameter(Mandatory=$true)]
[string]
$TfsServiceUri,
[Parameter(Mandatory=$true)]
[string]
$TfsUsernameClixml,
[Parameter(Mandatory=$true)]
[string]
$LogFilesPath,
[Parameter(Mandatory=$true)]
[string]
$TfsUserPasswordClixml,
[Parameter()]
[string]
$TfsConfigExePath="$Env:ProgramFiles\Microsoft Team Foundation Server 12.0\Tools\TfsConfig.exe"
)
if (Test-Path -Path $TfsUsernameClixml)
{
$tfsuser = (Import-CliXml -Path $TfsUsernameClixml)
}
else { return }
Remove-Item -Force -Path $ConfigIniFile -ErrorAction SilentlyContinue
# Stop any existing TFS 2013 build service
if (Get-Service -Name "TFSBuildServiceHost.2013" -ErrorAction Ignore)
{
$srv = Get-WmiObject -Class Win32_Service | Where-Object -FilterScript { ($PSItem.Name -ne $null) -and ($PSItem.Name.Equals("TFSBuildServiceHost.2013")) }
$srv.StopService() | Out-Null
$srv.Delete() | Out-Null
}
# Create the unattend file:
$inputparams = "ConfigurationType=scale;AgentCount=1;ExistingControllerName=$TfsBuildControllerName;CleanResources=True;CollectionUrl=$TfsServiceUri;IsServiceAccountBuiltIn=False;ServiceAccountName=$tfsuser"
$tfsconfoutput = & $TfsConfigExePath unattend /create /type:build /unattendfile:"$ConfigIniFile" /inputs:$inputparams 2>&1
$tfsconfoutput | Out-File -FilePath (Join-Path $LogFilesPath "TfsConfigUnattendFile.log") -Force
# Install the service:
$Error.Clear()
$tfsuserpswd = (Import-CliXml -Path $TfsUserPasswordClixml)
$tfsconfoutput = & $TfsConfigExePath unattend /configure /unattendfile:"$ConfigIniFile" /inputs:"ServiceAccountPassword=$tfsuserpswd" /continue 2>&1
Remove-Variable tfsuserpswd
$tfsconfoutput | Out-File -FilePath (Join-Path $LogFilesPath "TfsInstallUnattend.log") -Force
}
只要我在本地登录，我就可以在任何构建 Windows 2012 R2 代理上成功运行脚本 Configure-TfsBuildService.ps1。
除了 TFS 构建服务配置块之外，我还可以针对所有构建代理成功运行 DSC 配置。
但是，当我尝试运行 TFS 构建服务配置块时，我的 DSC 配置“成功”，但服务的无人值守配置失败，并显示以下日志消息：
[Info @15:40:47.754] +-+-+-+-+-| Verifying that the running account has required Team Foundation Server permissions |+-+-+-+-+-
[Info @15:40:47.754] Starting Node: TBPERMISSIONS
[Info @15:40:47.754] NodePath : VINPUTS/Progress/Conditional/TBPERMISSIONS
[Error @15:40:47.920]
Exception Message: TF30063: You are not authorized to access http://mytfsservice:8080/tfs/My_Collection. (type TeamFoundationServerUnauthorizedException)
Exception Stack Trace: at Microsoft.TeamFoundation.Client.Channels.TfsHttpWebRequest.SendRequest()
at Microsoft.TeamFoundation.Client.Channels.TfsHttpRequestChannel.Request(TfsMessage message, TimeSpan timeout)
at Microsoft.TeamFoundation.Client.Channels.TfsHttpClientBase.Invoke(TfsClientOperation operation, Object[] parameters, TimeSpan timeout, Object[]& outputs)
at Microsoft.TeamFoundation.Framework.Client.LocationWebService.Connect(Int32 connectOptions, Int32 lastChangeId, Int32 features)
at Microsoft.TeamFoundation.Framework.Client.FrameworkServerDataProvider.Connect(ConnectOptions connectOptions)
at Microsoft.TeamFoundation.Admin.AuthenticatedCollectionProvider.Microsoft.TeamFoundation.Admin.IAuthenticatedCollectionProvider.GetAuthenticatedConnection()
at Microsoft.TeamFoundation.Admin.VerifyPermissionsToConfigure.Run(ActivityContext context)
Inner Exception Details:
Exception Message: The remote server returned an error: (401) Unauthorized. (type WebException)Status: ProtocolError
Response Status Code: Unauthorized
Response Status Message: Unauthorized
Exception Stack Trace: at System.Net.HttpWebRequest.GetResponse()
at Microsoft.TeamFoundation.Client.Channels.TfsHttpWebRequest.SendRequestAndGetResponse(HttpWebRequest webRequest, WebException& webException)
[Info @15:40:47.920] Node returned: Error
[Error @15:40:47.920] TF30063: You are not authorized to access http://mytfsservice:8080/tfs/My_Collection.
[Info @15:40:47.920] Completed BuildServicePermissions: Error
[Info @15:40:47.920] -----------------------------------------------------
由于我使用自己的凭据运行 DSC 配置，并且我是 TFS 服务的项目集合管理员，因此不存在权限问题。我已经通过在代理计算机上本地成功运行配置脚本并在那里取得成功来证明了这一点。
我意识到 PowerShell 不允许双跳权限，但由于 DSC 在涉及的代理上执行，因此不应该存在双跳凭据问题，并且允许将权限中继到 TFS 服务进行注册。
也许我错过了一些更琐碎的事情？
编辑：TFS 2012/2013 无人值守安装的描述可在此处找到：http://blogs.msdn.com/b/visualstudioalm/archive/2012/10/12/unattended-installation-of-team-foundation-server-2012.aspx http://blogs.msdn.com/b/visualstudioalm/archive/2012/10/12/unattended-installation-of-team-foundation-server-2012.aspx
