"An Error occured during Logon." Audit Failure and Error 500 using RunAs for Dashboard

I’m experiencing an issue setting up a dashboard with RunAs where I’m encountering persistent Error 500 messages. The dashboard runs fine as the default account (minus the domain privileges it needs).

I’m seeing “An Error occurred during Logon.” Security Audit Failures corresponding to each attempt with or without the correct password. The Logon Type listed is 2.

The service account is a local Administrator which also has logon as batch job. RDP logon is typically disabled for SVC accounts but was enabled for testing.

The service account has full access to the install directory/responsitory.

PowerShell Universal is installed under IIS with the application pool running as LocalSystem.

I’ve tested with both BuiltInLocalVault and PSUSecretStore for PSCredential storage and the account is specified as “domain\username” but also tested as “username”.

I am admittedly using an older version of the application (2.9.3).

Are there other settings I’m missing to enable RunAs for dashboards?

The logging indicates:

2023-12-21 15:41:42.594 -06:00 [ERR] An unhandled exception has occurred while executing the request.
System.ComponentModel.Win32Exception (1783): The stub received bad data.
   at System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo)
   at System.Diagnostics.Process.Start()
   at UniversalAutomation.JobProcessManager.StartProcessAsCurrentUser(String powerShellPath, String commandLine, Variable credential) in D:\a\universal\universal\src\Universal.Server\Services\Automation\JobProcessManager.cs:line 233
   at UniversalAutomation.JobProcessManager.StartDashboard(Int32 port, ExecutionEnvironment environment, Variable credential) in D:\a\universal\universal\src\Universal.Server\Services\Automation\JobProcessManager.cs:line 50
   at Universal.Server.Services.DashboardProxy.Start(Dashboard dashboard) in D:\a\universal\universal\src\Universal.Server\Services\Dashboard\DashboardProxy.cs:line 121
   at Universal.Server.Services.DashboardManager.Start(Dashboard dashboard) in D:\a\universal\universal\src\Universal.Server\Services\Dashboard\DashboardManager.cs:line 111
   at UniversalAutomation.DashboardController.Start(Int64 id) in D:\a\universal\universal\src\Universal.Server\Controllers\DashboardController.cs:line 202
   at lambda_method1069(Closure , Object , Object[] )
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.SyncActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeActionMethodAsync()
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeNextActionFilterAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|24_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.InvokeFilterPipelineAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Authorization.Policy.AuthorizationMiddlewareResultHandler.HandleAsync(RequestDelegate next, HttpContext context, AuthorizationPolicy policy, PolicyAuthorizationResult authorizeResult)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Builder.Extensions.MapMiddleware.Invoke(HttpContext context)
   at Universal.Server.Middleware.RoutingMiddleware.Invoke(HttpContext httpContext, IPolicyEvaluator policyEvaluator) in D:\a\universal\universal\src\Universal.Server\Middleware\RoutingMiddleware.cs:line 153
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Universal.Server.Middleware.SwaggerAuthenticationMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in D:\a\universal\universal\src\Universal.Server\Middleware\SwaggerAuthMiddleware.cs:line 42
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass6_1.<<UseMiddlewareInterface>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at AspNetCoreRateLimit.RateLimitMiddleware`1.Invoke(HttpContext context) in D:\a\universal\universal\src\AspNetCoreRateLimit\Middleware\RateLimitMiddleware.cs:line 109
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)

OS: Windows Server 2022
IIS: 10.0.20348.1

Product: PowerShell Universal
Version: 2.9.3

I was able to resolve the audit/logon failures by changing the username format in the variable/pscredential from “domain\username” to upn format “username@domain.com”.

Windows logging is indicating the service account is now able to start the process. However, I’m still getting error 500 and failure to start the dashboard with the following logging indicating the process is not running:

2023-12-27 13:38:46.495 -06:00 [INF] Request starting HTTP/2 PUT https://pwshuniversal.mycompany.com/api/v1/dashboard/2/status - 0
2023-12-27 13:38:46.496 -06:00 [DBG] AuthenticationScheme: Cookies was successfully authenticated.
2023-12-27 13:38:46.496 -06:00 [DBG] The request has an origin header: 'https://pwshuniversal.mycompany.com'.
2023-12-27 13:38:46.497 -06:00 [INF] CORS policy execution successful.
2023-12-27 13:38:46.497 -06:00 [DBG] PUT requests are not supported
2023-12-27 13:38:46.497 -06:00 [DBG] PUT requests are not supported
2023-12-27 13:38:46.497 -06:00 [DBG] 1 candidate(s) found for the request path '/api/v1/dashboard/2/status'
2023-12-27 13:38:46.497 -06:00 [DBG] Endpoint 'UniversalAutomation.DashboardController.Start (Universal.Server)' with route pattern 'api/v1/dashboard/{id}/status' is valid for the request path '/api/v1/dashboard/2/status'
2023-12-27 13:38:46.497 -06:00 [DBG] Request matched endpoint 'UniversalAutomation.DashboardController.Start (Universal.Server)'
2023-12-27 13:38:46.498 -06:00 [DBG] AuthenticationScheme: Cookies was successfully authenticated.
2023-12-27 13:38:46.498 -06:00 [DBG] AuthenticationScheme: Bearer was not authenticated.
2023-12-27 13:38:46.498 -06:00 [INF] Authorization was successful.
2023-12-27 13:38:46.498 -06:00 [INF] Executing endpoint 'UniversalAutomation.DashboardController.Start (Universal.Server)'
2023-12-27 13:38:46.498 -06:00 [INF] Route matched with {action = "Start", controller = "Dashboard"}. Executing controller action with signature Microsoft.AspNetCore.Mvc.IActionResult Start(Int64) on controller UniversalAutomation.DashboardController (Universal.Server).
2023-12-27 13:38:46.498 -06:00 [DBG] Execution plan of authorization filters (in the following order): ["None"]
2023-12-27 13:38:46.498 -06:00 [DBG] Execution plan of resource filters (in the following order): ["Microsoft.AspNetCore.Mvc.ViewFeatures.Filters.SaveTempDataFilter"]
2023-12-27 13:38:46.498 -06:00 [DBG] Execution plan of action filters (in the following order): ["Microsoft.AspNetCore.Mvc.Filters.ControllerActionFilter (Order: -2147483648)","Microsoft.AspNetCore.Mvc.ModelBinding.UnsupportedContentTypeFilter (Order: -3000)"]
2023-12-27 13:38:46.498 -06:00 [DBG] Execution plan of exception filters (in the following order): ["None"]
2023-12-27 13:38:46.498 -06:00 [DBG] Execution plan of result filters (in the following order): ["Microsoft.AspNetCore.Mvc.ViewFeatures.Filters.SaveTempDataFilter"]
2023-12-27 13:38:46.498 -06:00 [DBG] Executing controller factory for controller UniversalAutomation.DashboardController (Universal.Server)
2023-12-27 13:38:46.498 -06:00 [DBG] Executed controller factory for controller UniversalAutomation.DashboardController (Universal.Server)
2023-12-27 13:38:46.498 -06:00 [DBG] Attempting to bind parameter 'id' of type 'System.Int64' ...
2023-12-27 13:38:46.498 -06:00 [DBG] Attempting to bind parameter 'id' of type 'System.Int64' using the name 'id' in request data ...
2023-12-27 13:38:46.498 -06:00 [DBG] Done attempting to bind parameter 'id' of type 'System.Int64'.
2023-12-27 13:38:46.498 -06:00 [DBG] Done attempting to bind parameter 'id' of type 'System.Int64'.
2023-12-27 13:38:46.498 -06:00 [DBG] Attempting to validate the bound parameter 'id' of type 'System.Int64' ...
2023-12-27 13:38:46.499 -06:00 [DBG] Done attempting to validate the bound parameter 'id' of type 'System.Int64'.
2023-12-27 13:38:46.513 -06:00 [DBG] Starting C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe with command line  -NoProfile -Command "& { [System.Reflection.Assembly]::LoadFrom('E:\inetpub\powershelluniversal\wwwroot\Host\host.dll') | Out-Null; [UniversalHost.AgentService]::StartDashboard(51727, 11604, 51654) }"
2023-12-27 13:38:46.513 -06:00 [INF] Starting job using Process.
2023-12-27 13:38:56.643 -06:00 [ERR] Dashboard process is not running. Dashboard may have crashed or failed to start.
2023-12-27 13:38:56.644 -06:00 [INF] Executed action UniversalAutomation.DashboardController.Start (Universal.Server) in 10145.354ms
2023-12-27 13:38:56.644 -06:00 [INF] Executed endpoint 'UniversalAutomation.DashboardController.Start (Universal.Server)'
2023-12-27 13:38:56.644 -06:00 [ERR] An unhandled exception has occurred while executing the request.
System.Exception: Failed to start dashboard. Waited 10 seconds for dashboard to start without a response. 
   at Universal.Server.Services.DashboardProxy.Start(Dashboard dashboard) in D:\a\universal\universal\src\Universal.Server\Services\Dashboard\DashboardProxy.cs:line 143
   at Universal.Server.Services.DashboardManager.Start(Dashboard dashboard) in D:\a\universal\universal\src\Universal.Server\Services\Dashboard\DashboardManager.cs:line 111
   at UniversalAutomation.DashboardController.Start(Int64 id) in D:\a\universal\universal\src\Universal.Server\Controllers\DashboardController.cs:line 202
   at lambda_method817(Closure , Object , Object[] )
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.SyncActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeActionMethodAsync()
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeNextActionFilterAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|24_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.InvokeFilterPipelineAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Authorization.Policy.AuthorizationMiddlewareResultHandler.HandleAsync(RequestDelegate next, HttpContext context, AuthorizationPolicy policy, PolicyAuthorizationResult authorizeResult)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Builder.Extensions.MapMiddleware.Invoke(HttpContext context)
   at Universal.Server.Middleware.RoutingMiddleware.Invoke(HttpContext httpContext, IPolicyEvaluator policyEvaluator) in D:\a\universal\universal\src\Universal.Server\Middleware\RoutingMiddleware.cs:line 153
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Universal.Server.Middleware.SwaggerAuthenticationMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in D:\a\universal\universal\src\Universal.Server\Middleware\SwaggerAuthMiddleware.cs:line 40
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass6_1.<<UseMiddlewareInterface>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at AspNetCoreRateLimit.RateLimitMiddleware`1.Invoke(HttpContext context) in D:\a\universal\universal\src\AspNetCoreRateLimit\Middleware\RateLimitMiddleware.cs:line 109
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)
2023-12-27 13:38:56.645 -06:00 [DBG] PUT requests are not supported
2023-12-27 13:38:56.646 -06:00 [DBG] PUT requests are not supported
2023-12-27 13:38:56.646 -06:00 [DBG] No candidates found for the request path '/Error'
2023-12-27 13:38:56.646 -06:00 [DBG] Request did not match any endpoints
2023-12-27 13:38:56.646 -06:00 [WRN] No exception handler was found, rethrowing original exception.
2023-12-27 13:38:56.646 -06:00 [ERR] Connection ID "17942340924839301221", Request ID "40001066-0002-f900-b63f-84710c7967bb": An unhandled exception was thrown by the application.
System.Exception: Failed to start dashboard. Waited 10 seconds for dashboard to start without a response. 
   at Universal.Server.Services.DashboardProxy.Start(Dashboard dashboard) in D:\a\universal\universal\src\Universal.Server\Services\Dashboard\DashboardProxy.cs:line 143
   at Universal.Server.Services.DashboardManager.Start(Dashboard dashboard) in D:\a\universal\universal\src\Universal.Server\Services\Dashboard\DashboardManager.cs:line 111
   at UniversalAutomation.DashboardController.Start(Int64 id) in D:\a\universal\universal\src\Universal.Server\Controllers\DashboardController.cs:line 202
   at lambda_method817(Closure , Object , Object[] )
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.SyncActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeActionMethodAsync()
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeNextActionFilterAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|24_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.InvokeFilterPipelineAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Authorization.Policy.AuthorizationMiddlewareResultHandler.HandleAsync(RequestDelegate next, HttpContext context, AuthorizationPolicy policy, PolicyAuthorizationResult authorizeResult)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Builder.Extensions.MapMiddleware.Invoke(HttpContext context)
   at Universal.Server.Middleware.RoutingMiddleware.Invoke(HttpContext httpContext, IPolicyEvaluator policyEvaluator) in D:\a\universal\universal\src\Universal.Server\Middleware\RoutingMiddleware.cs:line 153
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Universal.Server.Middleware.SwaggerAuthenticationMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in D:\a\universal\universal\src\Universal.Server\Middleware\SwaggerAuthMiddleware.cs:line 40
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass6_1.<<UseMiddlewareInterface>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at AspNetCoreRateLimit.RateLimitMiddleware`1.Invoke(HttpContext context) in D:\a\universal\universal\src\AspNetCoreRateLimit\Middleware\RateLimitMiddleware.cs:line 109
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.HandleException(HttpContext context, ExceptionDispatchInfo edi)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)
   at Microsoft.AspNetCore.Diagnostics.StatusCodePagesMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.ResponseCompression.ResponseCompressionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Server.IIS.Core.IISHttpContextOfT`1.ProcessRequestAsync()
2023-12-27 13:38:56.648 -06:00 [INF] Request finished HTTP/2 PUT https://pwshuniversal.mycompany.com/api/v1/dashboard/2/status - 0 - 500 - - 10152.2996ms
2023-12-27 13:38:56.648 -06:00 [DBG] Connection ID "17942340924839301221" disconnecting.

I can see the powershell.exe process start and stop as the service account but I’m not yet able to find system logging indicating why.

Edit: I’m not longer seeing the powershell.exe process starting/stopping in task manager but I am now seeing this pop up in the System logs "Application popup: powershell.exe - Application Error : The application was unable to start correctly (0xc0000142). Click OK to close the application. "