Fixed issue with test-admin check function not being found in IIS/SQL

Author: Bob Pokorny

IISU/PSHelper.cs

@@ -417,6 +417,33 @@ private void InitializeRemoteSession()
                         }
 
                         _logger.LogDebug("JEA pre-flight passed: Keyfactor modules are installed on the endpoint.");
+
+                        // Additional pre-flight: verify Test-KeyfactorAdminRights is available if admin check is required
+                        if (adminPrivilegesRequired)
+                        {
+                            PS.AddCommand("Invoke-Command")
+                                .AddParameter("Session", _PSSession)
+                                .AddParameter("ScriptBlock", ScriptBlock.Create("[bool](Get-Command 'Test-KeyfactorAdminRights' -ErrorAction SilentlyContinue)"));
+                            var adminCheckResults = PS.Invoke();
+                            PS.Commands.Clear();
+
+                            bool adminCheckAvailable = adminCheckResults != null &&
+                                adminCheckResults.Count > 0 &&
+                                adminCheckResults[0]?.BaseObject is bool adminCheckBool &&
+                                adminCheckBool;
+
+                            if (!adminCheckAvailable)
+                            {
+                                throw new Exception(
+                                    $"JEA endpoint '{jeaEndpoint}' requires the 'Test-KeyfactorAdminRights' function from Keyfactor.WinCert.Common module, but it is not available. " +
+                                    "Ensure the Keyfactor.WinCert.Common module is properly installed under " +
+                                    "'C:\\Program Files\\WindowsPowerShell\\Modules\\Keyfactor.WinCert.Common\\' on the target machine, " +
+                                    "and that the function is exposed in the JEA session configuration's VisibleFunctions list. " +
+                                    "After updating, re-register the JEA session configuration and restart WinRM.");
+                            }
+
+                            _logger.LogDebug("JEA pre-flight passed: Test-KeyfactorAdminRights is available on the endpoint.");
+                        }
                     }
 
                     // Set $InformationPreference globally so Write-Information output is forwarded

IISU/PowerShell/Keyfactor.WinCert.IIS/RoleCapabilities/Keyfactor.WinCert.IIS.psrc

@@ -24,11 +24,13 @@
     # Only the three public IIS functions need to be visible to the caller.
     # Internal helpers (New-KeyfactorResult, Get-CertificateCSP, Add-IISBindingWithSSL, etc.)
     # are called from within trusted module code and do not require explicit exposure.
+    # Test-KeyfactorAdminRights is called by the orchestrator's C# code when adminPrivilegesRequired=true.
     VisibleFunctions = @(
         'Get-KeyfactorIISBoundCertificates',
         'New-KeyfactorIISSiteBinding',
         'Remove-KeyfactorIISSiteBinding',
-        'Remove-KeyfactorIISCertificateIfUnused'
+        'Remove-KeyfactorIISCertificateIfUnused',
+        'Test-KeyfactorAdminRights'
     )
 
     VisibleCmdlets = @(

IISU/PowerShell/Keyfactor.WinCert.SQL/RoleCapabilities/Keyfactor.WinCert.SQL.psrc

@@ -29,10 +29,12 @@
     ModulesToImport = @('Keyfactor.WinCert.Common', 'Keyfactor.WinCert.SQL')
 
     # Functions the orchestrator is allowed to invoke in this JEA session.
+    # Test-KeyfactorAdminRights is included for potential future use when admin checks are required.
     VisibleFunctions = @(
         'Get-KeyfactorSQLInventory',
         'New-KeyfactorSQLBinding',
-        'Remove-KeyfactorSQLCertificate'
+        'Remove-KeyfactorSQLCertificate',
+        'Test-KeyfactorAdminRights'
     )
 
     # Cmdlets available to caller scriptblocks (param() wrappers sent by PSHelper).

README.md

@@ -524,6 +524,43 @@ The function is not visible in the JEA session. Verify that:
 * The module name in `RoleCapabilities` matches the module folder name exactly (case-sensitive on some systems).
 * The session configuration was re-registered and WinRM was restarted after any changes.
 
+**"The term 'Test-KeyfactorAdminRights' is not recognized..."**
+
+This function is called automatically by the orchestrator when managing IIS bindings (which require administrator rights). The error indicates that `Test-KeyfactorAdminRights` is not exposed in the JEA session. This function is defined in the `Keyfactor.WinCert.Common` module but must be explicitly listed in the `VisibleFunctions` array of any role capability that needs it.
+
+**For IIS certificate stores:** Ensure the `Keyfactor.WinCert.IIS.psrc` file includes `Test-KeyfactorAdminRights` in its `VisibleFunctions` list:
+
+```powershell
+VisibleFunctions = @(
+    'Get-KeyfactorIISBoundCertificates',
+    'New-KeyfactorIISSiteBinding',
+    'Remove-KeyfactorIISSiteBinding',
+    'Remove-KeyfactorIISCertificateIfUnused',
+    'Test-KeyfactorAdminRights'   # <-- Required for admin rights check
+)
+```
+
+After updating the role capability file, **no re-registration is necessary** — the next JEA session will pick up the updated module automatically. However, if you made changes to the `.pssc` file itself, you must re-register it and restart WinRM:
+
+```powershell
+Register-PSSessionConfiguration `
+    -Name 'keyfactor.wincert' `
+    -Path 'C:\Temp\KeyfactorWinCert.pssc' `
+    -Force
+
+Restart-Service WinRM
+```
+
+**Verification:** Connect to the JEA endpoint and verify the function is now available:
+
+```powershell
+$s = New-PSSession -ComputerName '<target-server>' `
+                   -ConfigurationName 'keyfactor.wincert' `
+                   -Credential (Get-Credential)
+Invoke-Command -Session $s -ScriptBlock { Get-Command Test-KeyfactorAdminRights }
+Remove-PSSession $s
+```
+
 **"Connecting user is not authorized to connect to this configuration"**
 
 The account used in the certificate store credentials is not a member of any group listed in `RoleDefinitions`. Add the account (or a group containing it) to the `RoleDefinitions` section in the `.pssc`, re-register the configuration, and restart WinRM.