Run custom script extension as domain user

Question

Hi,

Goal: AD Join storage account running CSE to run as domain user and execute script

I’ve been trying to run a script on a domain joined VM (using CSE) to domain join a storage account. The requirement for this is that it has to run with a hybrid/domain admin. I have already tested executing this script as local admin account and it has worked perfectly fine in running the script as the domain admin in a new session (using admin credentials & Invoke-Command). However when I execute this script through custom script extension I get the following error:

Error
"message": "New-PSSession : [localhost] Connecting to remote server localhost failed with the following error message : Access is \r\ndenied. For more information, see the about_Remote_Troubleshooting Help topic.\r\nAt C:\Packages\Plugins\Microsoft.Compute.CustomScriptExtension\1.10.9\Downloads\0\customScript.ps1:46 char:25\r\n+ ... erSession = New-PSSession -Credential $credential -Authentication Cre ...\r\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n

The precise line it fails in the script is here:
New-PSSession -Credential $credential -Authentication Credssp;

Steps tried (so far)
• I understand that CSE runs scripts as a system account so was trying to reproduce the issue using Invoke-CommandAs with system user but could not repro the issue.
• I’ve also tried to run this using psexec similar to the example found here (line 173 & 177): https://github.com/Azure/wvdquickstart/blob/ede9daad93a80056cbb4d187990dd769733182b3/Uploads/WVDScripts/001-AzFiles/cse_run.ps1 but have had no luck yet as I get auth & other failures

Note: I've found that I have to add the domain user to the local admin group when running invoke command otherwise I get access denied, which may perhaps be a restriction from my enterprise AD (that is locally).

• My code $group = ADSI
  $group.add("WinNT://$domainUser,user") $domainSession = New-PSSession -Credential $domainCredential -Authentication Credssp; try{
  Invoke-Command -Session $domainSession -ScriptBlock {pwsh -ExecutionPolicy Unrestricted -File $Using:joinDomainScriptPath $args
  }