I'm looking for a good reference to understand what actually behinds the scene of Invoke-Command. Does this retrieve current logged user context to run command remotely? So saying I'm a domain admin who has administrative rights on target joined computers so what I'd need to do just like
Invoke-Command -ComputerName mypc -FilePath "C:\Script\stuff.ps"
Connecting to remote serve mypc failed with the following error
message : WinRM cannot complete the operation. Verify that the
specified computer name is valid, that the computer is accessible over
the network, and that a firewall exception for the WinRM service is
enabled and allows access from this computer. By default, the WinRM
firewall exception for public profiles limits access to remote
computers within the same local subnet.
If I try with the following code snippet I'm able to access to the pc
$so = New-PsSessionOption –SkipCACheck -SkipCNCheck
Enter-PSSession -ComputerName mypc -Credential contoso\admin -UseSSL -SessionOption $so -Authentication Kerberos
The error output from Invoke-Command seems to indicate that it uses WinRm but I don't know the main difference between the first compared with the second one.
Related
I have written a PowerShell script which uninstall a program and install a newer version of the program on my servers (Update Programs). Now I want to create another script which run the aforementioned script on the servers. Consider that I have to connect to my servers through using IPs, UserName and password and using domain is not an option.
How is this possible?
PowerShell version is 4
I have tried this code to simply get date:
$User = "administrator"
$PWord = ConvertTo-SecureString -String "Password1234" -AsPlainText -Force
$Credential = New-Object -TypeName "System.Management.Automation.PSCredential" -ArgumentList $User, $PWord
$session = New-PSSession -ComputerName '10.60.60.100' -Credential $Credential
Invoke-Command -Session $session -ScriptBlock {Get-Date}
and I got this error:
New-PSSession : [10.60.60.100] Connecting to remote server 10.60.60.100 failed with the following error message : The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain, then HTTPS transport must be used or the destination machine must be added to the TrustedHosts configuration setting. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. You can get more information about that by running the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
This is because you’re not running your command from a trusted host, or because the remote computers wsman service isn’t configured properly. I’d start by running the following command to configure wsman on the remote machine:
wsman quickconfig
If that doesn’t fix the problem, then you need to add your computer to the remote machines trusted hosts. You can do that by running the following:
winrm s winrm/config/client '#{TrustedHosts="RemoteComputer"}'
A Proxy server is used for the LAN connectivity in my machine and when i try to create a remote powershell session using the command Enter-PSSession in my machine, powershell console throws the following exception,
First Try: Enter-PSSession -ComputerName server.com -Credential domain\user
Now, I tried along with -UseSSL option. Below is the exception i received this time,
Second Try: Enter-PSSession -ComputerName server.com -Credential domain\user -useSSL
Can anyone please let me know how to create remote powershell session when in proxy LAN connection ?
In order to set proxy settings on connections for PS Remoting, use the New-PSSessionOptions commandlet and save the results as an object. $sessionOptions = New-PSSessionOptions [...] (you may need to research the options to specify there)
Then, use this object as a parameter on the -SessionOptions switch
I can not remote into any machine to save my life! I have tried everything I can find. If anyone could troubleshoot or guide me, I'd appreciate it as this would be a great tool to add on my domain.
SETUP:
Client machine inside domain
Server machine inside or outside domain - Virtualized and utilized for WSUS Computername: wsustest
CLIENT SERVER MACHINE physical- computername: epizzi-pc
STEPS:
enable-pssremoting done! on all machines
trustedhosts configured with * or client machine added
Firewalls with public profile off just in case
Enter-PSSession -ComputerName wsustest -Credential wsustest\administrator
Enter-PSSession -ComputerName epizzi-pc -Credential epizzi-pc\administrador
Enter-PSSession : Connecting to remote server epizzi-pc failed with the following error message : WinRM cannot process the request. The following error with errorcode 0x80090311
occurred while using Kerberos authentication: There are currently no logon servers available to service the logon request.
Possible causes are:
-The user name or password specified are invalid.
-Kerberos is used when no authentication method and no user name are specified.
-Kerberos accepts domain user names, but not local user names.
-The Service Principal Name (SPN) for the remote computer name and port does not exist.
-The client and remote computers are in different domains and there is no trust between the two domains.
After checking for the above issues, try the following:
-Check the Event Viewer for events related to authentication.
-Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
Note that computers in the TrustedHosts list might not be authenticated.
-For more information about WinRM configuration, run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ Enter-PSSession -ComputerName epizzi-pc -Credential epizzi-pc\administrador
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (epizzi-pc:String) [Enter-PSSession], PSRemotingTransportException
+ FullyQualifiedErrorId : CreateRemoteRunspaceFailed
Enter-PSSession -ComputerName wsustest -UseSSL -Credential wsustest\administrator
*Enter-PSSession : Connecting to remote server wsustest failed with the following error message : WinRM cannot complete the operation. Verify that the specified computer name is
valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM
firewall exception for public profiles limits access to remote computers within the same local subnet. For more information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ Enter-PSSession -ComputerName wsustest -UseSSL -Credential wsustest\administrato ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (wsustest:String) [Enter-PSSession], PSRemotingTransportException
+ FullyQualifiedErrorId : CreateRemoteRunspaceFailed*
ERRORs:
I was receiving the same problem when remoting to a server and found this blog post very helpful - http://jeffgraves.me/2013/10/14/powershell-remoting/
For my specific case I did the following:
On the Local machine
winrm quickconfig (although this was already configured)
winrm s winrm/config/client '#{TrustedHosts="myservername.domain"}'
On the Remote machine
enable-psremoting -force
Set-PSSessionConfiguration -ShowSecurityDescriptorUI -Name Microsoft.PowerShell -Force
I got around this problem by using a fully qualified logon. Instead of "netbiosdomain\accountname", I used fqdn\accountname, as in Microsoft.com\myaccount in the get-credential prompt. May not work for everyone, but it's worth a shot.
This is how I do it. I use this on my scripts.
# This is only done once
Read-Host -AsSecureString | ConvertFrom-SecureString | Out-File
c:\Windows\temp\securepass.txt
# Setup credentials
$SecureString = Get-Content c:\Windows\temp\securepass.txt | ConvertTo-SecureString
$mycredentials = New-Object -TypeName System.Management.Automation.PSCredential
-ArgumentList "yourDomain\userID",$SecureString
# Open remote session:
$MyRSession = New-PSSession -ComputerName Computer1 -Credential $mycredentials
-Authentication default
# Use remote session:
Enter-PSSession $MyRSession
Get rid of -UseSSL. I enabled PSRemoting and had problems with using that. I guess I could look at it later but for now it doesn't matter.
If there is no trust between the client and server computers, you have to enable basic authentication on the server side. Do this by toggling the correct properties on the WSMAN: drive on the server. You'll obviously have to do this interactively on the console or via remote desktop, due to the chicken and egg problem :) Also, this may come into play too:
http://www.nivot.org/blog/post/2009/10/30/PowerShell20EnablingRemotingWithVirtualXPModeOnWindows7
I was getting that same error currently no logon servers available.
The issue was resolved by using instead of Domain\Username as credentials the user UPN or Username#Domain.
I have achieved a remote session with Enter-pssession command, had to follow these exact parameters
$creds = get-credential (the -credential parameter in enter-pssession does not work properly, thus u must previously enter the object at another variable)
Enter-pssession -computername wsustest -authentication Default -credentials $creds
i Also had to set both client and remote server in the trusted hosts wsman: space
another solution which surely wouldve worked but i havent tried, wouldve been setting https: which is harder to do.
thx to all, your comments certainly led to the solution!
I cannot connect to remote server using enter-pssession -computername serverA. My scenario:
I have 2 Win 2003 R2 servers in the same domain. ServerA is WSUS server, serverB is a domain controller
Both servers have enabled powershell remoting
Both servers have configured winrm (winrm quickconfig)
Both servers have TrustedHosts set to *
setspn.exe is set up correctly (http, https, wsman etc.)
Both servers have FireWall turned off
Both servers have PowerShell 2.0
I am trying to enter-pssession -computername serverA under the domain admin credentials from serverB to serverA and it throws the following error:
"""Enter-PSSession : Connection to remote server failed with the following error message : WinRM cannot process the request. The following error occured while using Kerberos authentication: The network path was not found."""
When I try to enter-pssession -computername serverB under the domain admin credentials from serverA it works fine! It also works if I use localhost so: enter-pssession -computername localhost under the domain admin credentials (on serverA) works as well, but when I try the hostname on serverA (instead of localhost) enter-pssession -computername serverA it throws the same error.
I also tried to use get-credential and provide different types of credentials, but it did not help. The only thing which helped was using a local (not domain) administrator account and running enter-pssession -computername serverA -credentials $cred and it worked, but only locally, I was able to do this from local machine (from serverA to itself) but not from serverB to serverA under the serverA\administrator credentials.
Any ideas?
Thanks
First of all I created credential variable with my domain admin account:
$cred = get-credential - I typed my domain\username and password
Then I used IP address instead of hostname in -ComputerName parameter, so the enter-pssession looks like:
Enter-Pssession -ComputerName 192.168.1.111 -Credential $cred
this approach works for the invoke-command as well
invoke-command -ComputerName 192.168.1.111 -Credential $cred -ScriptBlock {hostname}
I still do not know why it does not work with the hostname and why do I have to create $cred, but as I need a quick solution, this works fine for me.
Thanks for help.
I had the exact same issue. Using the FQDN worked for me.
Chris N is right:
The network path was not found.
This is clearly a DNS resolution error; especially if the IP address is working. I would venture to say there are Name Suffix Routing issues.
The ComputerName description says that NETBIOS name should work, but it does not in my testing in my environment. The FQDN is another option for the -ComputerName property and fixed this error for me.
Try using (use your FQDN, of course):
Invoke-Command -ComputerName servera.vertigion.com
Note: Notice it's in all lowercase. Using camel case (serverA.vertigion.com) failed with the same error. I realize that typically nslookups are case-insensitive.
Note: I did NOT have the issue with the Enter-PSSession command. I believe there's a bug (or at least a blatant inconsistency) with Invoke-Command.
More info: http://go.vertigion.com/PowerShell_Invoke-Command
It sounds like the issue is with name resolution. You can confirm this by pinging ServerA from ServerB. If it fails you could work from there. Try pinging by FQDN (servera.mydomain.com) or by IP.
See more info here. I ran into this in a pair of servers that had been working but then spontaneously stopped and started issuing the OP's error message. I rebooted the target server and that got things working again.
Set TCP/IP NETBIOS service to auto start, and enable service.
also allow NETBIOS in adapter properties if needed.
In order to automate test releases, I need access to remote computer in other domain group.
What I've done on remote computer:
run Enable-PSRemoting
set TrustedHosts "*"
added https listener with self-signed certificate
opened 5985 and 5986 ports
So now scripts are running successfuly via PowerShell console.
But when I'm trying to run remote script via TeamCity agent I've been receiving following error:
Connecting to remote server failed with the following error message :
Access is denied. For more information, see the
about_Remote_Troubleshooting Help topic.
TeamCity agent service is running with Local System rights.
Session initialization
$password = ConvertTo-SecureString $appServerPwd -AsPlainText -Force
$appCred = New-Object System.Management.Automation.PsCredential($appServerUser,$password)
$rs = New-PSSession -ComputerName $appServer -Credential $appCred -UseSSL -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck) -Authentication Negotiate
Also when I'm trying to make remote call to domain computer via TeamCity everything works.
Do you have any idea how to solve this issue ?
Dima
I've found the problem, as soon I changed "Local System" user to Administrator user on TeamCity agent service, everything started to work.
So the issues was in rights (starting PSSesion) between "Local System" and Administrator.