I’m building a workflow that uses PTA to execute PowerShell scripts on a Windows server as a service account. The workflow triggers on idn:account-created and calls a PowerShell script to generate a unique UPN/email alias and set it on the AD account before enabling an Exchange mailbox.
The problem:
The script runs successfully on the PTA server but fails when trying to query or update Active Directory:
FAILED: Unable to contact the server. This may be because this server does not exist, it is currently down, or it does not have the Active Directory Web Services running.
This happens on Get-ADUser and Set-ADUser calls. The same commands work fine in a direct PowerShell session on the server. Kerberos double-hop might be the issue - WinRM delivers the script to the PTA server (hop 1) but the session can’t forward credentials to the DC (hop 2).
What I’ve tried:
- Switched from NTLM to Kerberos auth
- Switched Kerberos protocol from UDP to TCP
- Switched credential provider from CyberArk CCP to ISC Parameter Storage
- Confirmed service account username in Parameter Storage has no domain prefix
- Tried passing credentials as script arguments using secrets:// — ISC blocks them in inputForPag_script_arguments, only resolved in auth fields
- Confirmed port 9389 is open from PTA server to DC
Questions:
- What is the recommended approach for PTA scripts that need to make AD calls?
- Is there a supported way to make resolved credentials available inside the script without passing them as script arguments?
- Has anyone had to make changes to the PTA service account in Active Directory to get this working, such as configuring Kerberos Constrained Delegation
or any other delegation settings? If so, what specifically was configured?
Any guidance appreciated. Thanks!