Hybrid Worker Service from Azure on a local [on-premise] machine

 

To run a Hybrid Worker Service from Azure on a local on-premise machine.

 

If you want to use an Azure Automation account with a credential from on-premise AD, you have to do quite a few tricks to give the on-premise AD account enough access rights so the HybridWorkerService can actually use and run it.

 

Do this by granting the on-premise account access to the AzureConnectedMachineAgent Tokens:-

 

icacls "C:\ProgramData\AzureConnectedMachineAgent\Tokens" `

    /grant "<COMPANY\serviceAccountName>:(OI)(CI)(R)" /T

 

$Account = ‘<COMPANY\serviceAccountName>’

$Keys = @(

    @{Path='HKLM:\SYSTEM\CurrentControlSet\Services\EventLog'; Rights='ReadKey'},

    @{Path='HKLM:\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters'; Rights='FullControl'},

    @{Path='HKLM:\SOFTWARE\Microsoft\Wbem\CIMOM'; Rights='FullControl'},

    @{Path='HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root'; Rights='FullControl'},

    @{Path='HKLM:\SOFTWARE\Microsoft\SystemCertificates'; Rights='FullControl'},

    @{Path='HKLM:\SOFTWARE\Microsoft\EnterpriseCertificates'; Rights='FullControl'},

    @{Path='HKLM:\SOFTWARE\Microsoft\HybridRunbookWorker'; Rights='FullControl'},

    @{Path='HKLM:\SOFTWARE\Microsoft\HybridRunbookWorkerV2'; Rights='FullControl'},

    @{Path='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles'; Rights='FullControl'}

)

foreach ($Entry in $Keys) {

    if (-not (Test-Path $Entry.Path)) {

        Write-Warning "Skipping missing key: $($Entry.Path)"

        continue

    }

    $acl = Get-Acl $Entry.Path

    $rule = New-Object System.Security.AccessControl.RegistryAccessRule(

        $Account,

        $Entry.Rights,

        'ContainerInherit',

        'None',

        'Allow'

    )

    $acl.SetAccessRule($rule)

    Set-Acl -Path $Entry.Path -AclObject $acl

    Write-Host "Granted $($Entry.Rights) -> $($Entry.Path)" -ForegroundColor Green

}