使用azurerm_windows_vmss挂载Azure FileShare遇障求助

尝试通过Terraform的azurerm_windows_virtual_machine_scale_set配合CustomScriptExtension实现Azure FileShare全用户挂载，使用PSEXEC执行脚本时出现以下错误：

Connecting to local system...\r\n\r\n\r\nCouldn't install PSEXESVC service:\r\nThe handle is invalid.\r\nConnecting to local system...\r\n\r\n\r\nStarting PSEXESVC service on local system...\r\n\r\n\r\nCopying authentication key to...

用户的Terraform配置：

resource "azurerm_windows_virtual_machine_scale_set" "example" {
  count               = 1
  name                = "example"
  location            = "mylocation"
  resource_group_name = "myRG"
  
  identity {
    type = "SystemAssigned"
  }

  enable_automatic_updates = true
  computer_name_prefix = "myexample"
  instances           = 1
  sku                = int
  admin_username      = "myadmin"
  admin_password      = "mypass"
  source_image_id = data.azurerm_shared_image_version.edi_image_backend_version.id
 
  extension_operations_enabled = true

  extension {
    name                         = "EDI-CustomScript"
    publisher                    = "Microsoft.Compute"
    type                         = "CustomScriptExtension"
    type_handler_version         = "1.10"
    settings = <<SETTINGS
    {
      "fileUris": [
        "${file.url}",
        "${psexec.url}"
      ],
       "commandToExecute" : "powershell -Command \"Enable-PSRemoting -Force\" ;.\\psexec -u ${USER} -p ${PASS} -accepteula -nobanner -s -h  powershell.exe -File ${file.name} -StorageAccountAccessKey ${AccesKey} -FileShare ${fileshare} -StorageAccount ${storageaccount.name}"
   }
    SETTINGS
    protected_settings = <<SETTINGS
      {
        "storageAccountName": "${storageaccount}",
        "storageAccountKey": "${storageaccountkey}"
      }
      SETTINGS
  }
  tags = {
      environment = "${var.environment}"
    }
}

原挂载脚本：

param(
    [Parameter(Mandatory=$true)]
    [string]$FileShare,

    [Parameter(Mandatory=$true)]
    [string]$StorageAccountAccessKey,
    
    [Parameter(Mandatory=$true)]
    [string]$StorageAccount
)

cmd.exe /C "cmdkey /add:`"${StorageAccount}.file.core.windows.net`" /user:`"localhost\${StorageAccount}`" /pass:`"${StorageAccountAccessKey}`""
# Mount the drive
net use "Z:" "\\${StorageAccount}.file.core.windows.net\${FileShare}" /persistent:yes

1. 弃用PSEXEC，改用系统级挂载方案 #

PSEXEC在CustomScriptExtension的受限环境下易出现服务安装、权限问题，直接通过注册表+系统凭据实现全用户挂载更可靠。

2. 修改挂载脚本，实现全局持久化挂载 #

替换原脚本为以下内容，确保驱动器对所有用户可见且自动挂载：

param(
    [Parameter(Mandatory=$true)]
    [string]$FileShare,
    [Parameter(Mandatory=$true)]
    [string]$StorageAccountAccessKey,
    [Parameter(Mandatory=$true)]
    [string]$StorageAccount
)

# 添加Azure文件共享标准格式的系统凭据（全局生效）
cmd.exe /C "cmdkey /add:`"${StorageAccount}.file.core.windows.net`" /user:`"Azure\${StorageAccount}`" /pass:`"${StorageAccountAccessKey}`""

# 创建注册表项，设置驱动器为全局可见
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices"
if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}
New-ItemProperty -Path $regPath -Name "Z:" -Value "\\${StorageAccount}.file.core.windows.net\${FileShare}" -PropertyType String -Force | Out-Null

# 立即挂载并设置持久化
net use "Z:" "\\${StorageAccount}.file.core.windows.net\${FileShare}" /persistent:yes

注意：将用户名格式改为Azure\${StorageAccount}，这是Azure文件共享的标准身份格式，避免凭据识别错误。

3. 简化Terraform的CustomScriptExtension配置 #

移除PSEXEC相关依赖，直接执行挂载脚本：

extension {
  name                         = "EDI-CustomScript"
  publisher                    = "Microsoft.Compute"
  type                         = "CustomScriptExtension"
  type_handler_version         = "1.10"
  settings = <<SETTINGS
  {
    "fileUris": [
      "${file.url}"
    ],
    "commandToExecute" : "powershell -ExecutionPolicy Bypass -File ${file.name} -StorageAccountAccessKey ${AccesKey} -FileShare ${fileshare} -StorageAccount ${storageaccount.name}"
  }
  SETTINGS
  protected_settings = <<SETTINGS
  {
    "storageAccountName": "${storageaccount}",
    "storageAccountKey": "${storageaccountkey}"
  }
  SETTINGS
}

• 移除PSEXEC的下载链接和命令调用
• 添加-ExecutionPolicy Bypass确保脚本可正常执行

4. 权限与身份优化（可选） #

• 给VMSS的系统分配身份添加Storage File Data SMB Share Contributor权限，可替代存储密钥，提升安全性
• 若使用存储密钥，确保密钥有效且拥有文件共享的读写权限

5. 域环境替代方案 #

如果VM加入AD域，可通过组策略配置驱动器映射，实现更统一的全用户挂载管理。

内容的提问来源于stack exchange，提问作者user3922604