Enter-PSSession is not working with port 5986 - powershell

Enter-PSSession command works on remote PC with port 5985, but whenever I specify the port 5986 (HTTPS), it shows the following error:
Enter-PSSession : Connecting to remote server localhost failed with the
following error message : The client cannot connect to the destination
specified in the request. Verify that the service on the destination is
running and is accepting requests. Consult the logs and documentation for
the WS-Management service running on the destination, most commonly IIS
or WinRM. If the destination is the WinRM service, run the following
command on the destination to analyze and configure the WinRM service:
"winrm quickconfig". For more information, see the
about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ Enter-PSSession -ComputerName localhost -Port 5986
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (localhost:String) [Enter-PSSession], PSRemotingTransportException
+ FullyQualifiedErrorId : CreateRemoteRunspaceFailed
I have tried to enable port 5986 in firewall and even completely disabled the firewall but still can't solve the problem. So, how can I enable port 5986 for PSSession?

I was faced with this problem.
Check firewall rule. Port 5986 must be allowed for inbound connections.
Are you created certificate on server? If not then...
Run in PowerShell as Administrator:
New-SelfSignedCertificate -DnsName <your_server_dns_name_or_whatever_you_like> -CertStoreLocation Cert:\LocalMachine\My
and save returned thumbprint. Thumbprint will you need.
Are you configured WinRM on server? If not then... Run cmd.exe as Administrator and run it:
winrm create winrm/config/Listener?Address=*+Transport=HTTPS #{Hostname=”<your_server_dns_name_or_whatever_you_like>”; CertificateThumbprint=”<certificate_thumbprint_from powershell>”}`
Try login to server:
$so = New-PsSessionOption –SkipCACheck -SkipCNCheck
Enter-PSSession -ComputerName <ip_address_or_dns_name_of_server> -Credential <local_admin_username> -UseSSL -SessionOption $so
Also may be you need configure winrm for client. Run cmd.exe as Administrator and run it:
winrm set winrm/config/client #{TrustedHosts="<ip_remote_server>"}

Related

New-PSSession - Connecting to remote server failed

I have two Windows 7 Pro systems, one host system and one in a VM one the host system. I am trying to create a New PSSession on the host system to control the guest, both of which run Powershell 4.0.
As we have a DHCP setup in the office the first thing I do is establish the IP adress of each. Then I run the code below on both machines -
Set-Item wsman:\localhost\client\trustedhosts "$relevantIP" -Force
I then test that the systems are ready using WSMan on the host -
Test-WSMan $remoteIP
wsmid : http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd
ProtocolVersion : http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd
ProductVendor : Microsoft Corporation
ProductVersion : OS: 0.0.0 SP: 0.0 Stack: 3.0
All this works perfectly well. At this point I used to create a new PSSession using the following
$credObject =
$Host.ui.PromptForCredential(
"Need credentials",
"Please enter password for the following IP $remoteIP",
$remoteUsername,
""
)
$remoteSession = New-PSSession -ComputerName $remoteIP -Credential $credObject
New-PSSession : [10.141.114.91] Connecting to remote server
10.141.114.91 failed with the following error message : The WinRM client cannot process the request. Default authentication may be used
with an IP address under the following conditions: the transport is
HTTPS or the destination is in the TrustedHosts list, and explicit
credentials are provided. Use winrm.cmd to configure TrustedHosts.
Note that computers in the TrustedHosts list might not be
authenticated. For more information on how to set TrustedHosts run
the following command: winrm help config. For more information, see
the about_Remote_Troubleshooting Help topic. At line:1 char:18
+ $remoteSession = New-PSSession -ComputerName "10.141.114.91" -Credential "SESA40 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession],
PSRemotingTransportException
+ FullyQualifiedErrorId : CannotUseIPAddress,PSSessionOpenFailed
I have no idea why it has started doing this when trying to connect to the VM from the host system. I can create a new PSSession on the host machine from within the guest but no longer the other way around.
The error message says that "Default
authentication may be used with an IP address under the following conditions: ... the destination is in the TrustedHosts list and explicit credentials are provided." I have already added the correspoding IP to each WSMan TrustedHosts fields and provide explicit credentials.
Any help would be greatly appreciated as I am scratching my head trying to think of what could be wrong.
Update
After following the suggestion of one commentor I tried using different authentification methods.
$remoteSession = New-PSSession -ComputerName "10.141.114.91" -Credential "Test" -ErrorAction Stop -Authentication Basic
The WinRM client cannot process the request. Unencrypted traffic is currently
disabled in the client configuration. Change the client configuration and try the request again.
So I ran set-item WSMan:\localhost\Client\allowunencrypted $true on both machines. Now trying to get a PSSession gives the error
Get-PSSession -ComputerName "10.141.114.91" -Credential "Test" -Authentication Basic
The WinRM client cannot process the request. If the authentication scheme is
different from Kerberos, or if the client computer is not joined to a domain, then HTTPS transport must be used or the destination machine must be added to the TrustedHosts configuration setting.
** Update 2 **
In case anyone has the same problem and comes across this - my problem turned out to be a combination of a network fault and then with my playing around somehow creating a list of IP addresses for wsman:\localhost\client\trustedhosts which missed a comma between IP's.

Error when to resolve Double Hop issue with powershell

Today we need to resolve double hop issue with PowerShell.
But it is failed when we do following try:
Machines: client1, server1, networkpath
One client1 run following:
$session = New-PSSession -Computer server1 -Authentication Credssp -Credential "username"
Following error thrown:
New-PSSession : [server1] Connecting to remote server server1 failed with the
following error message : The WinRM client cannot process the request. The
authentication mechanism requested by the client is not supported by the server
or unencrypted traffic is disabled in the service configuration. Verify the
unencrypted traffic setting in the service configuration or specify one of the
authentication mechanisms supported by the server. To use Kerberos, specify the
computer name as the remote destination. Also verify that the client computer
and the destination computer are joined to a domain. To use Basic, specify
the computer name as the remote destination, specify Basic authentication and
provide user name and password. Possible authentication mechanisms reported by
server: Negotiate For more information, see the about_Remote_Troubleshooting
Help topic.
At line:1 char:12
+ $session = New-PSSession -Computer server1 -Authentication Credssp -Creden ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotin gTransportException
+ FullyQualifiedErrorId : AccessDenied,PSSessionOpenFailed
We have done following configuration:
Client1:
Enable-WSManCredSSP -Role Client -DelegateComputer Server1
Server1:
Enable-WSManCredSSP -Role Server
All servers are in workgroup.
Following suggestions from Resolve Double-Hop Issue in PowerShell Remoting
following steps can fix the err
Run gpedit.msc on client.
Expand to Local Computer Policy -> Computer
Configuration -> Administrative Templates -> System -> Credentials
Delegation.
Double click Allow Delegating Fresh Credentials with NTLM-only Server Authentication.
Enable Allow Delegating Fresh Credentials.
Click Show... and add wsman/Server1.
Click several OK to close the popup dialogs.
Now we can run following script successful on client:
$session = New-PSSession -Computer server1 -Authentication Credssp -Credential "username"
Enter-PSSession $session
Test-Path "NetWorkPath"
Posting this solution in case someone is still having an issue with a simple resolution to DoubleHop without using CredSSP.
Try this out:
https://www.powershellgallery.com/packages/Invoke-PSSession
It Invokes a PSSession, then Registers a PSSessionConfiguration with the Credentials that you provided. Basically providing the credentials for that DoubleHop

How to connect to remote server using powershell

I am trying to connect to a remote server but getting the following error
[my ip] Connecting to remote server "my ip" failed with the following error message : The WinRM client cannot process the request. Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
CategoryInfo : OpenError: (my ip:String) [], PSRemotingTransportException
FullyQualifiedErrorId : CannotUseIPAddress,PSSessionStateBroken
I am using this command to run a PowerShell script from my local machine on a remote PC
This is my script
$serverName = 'my ip'
$pwd = convertto-securestring "password12" -asplaintext -force
$cred=new-object -typename System.Management.Automation.PSCredential -argumentlist
".\Administrator",$pwd
Invoke-Command -computername $serverName {$("C:\_Projects\test.ps1")}
Edit:
my local pc and remote computer are not on the same domain . for example my local pc says mypc.test.local and remote computer says workgroup. Can some one help how to sort the above error by not changing the settings on remote computer, because its a UAT server.
You need to add -credential $cred to your Invoke-command command. You may also need to remove the .\ from the Administrator name--I don't have a workgroup server to test with, so I can't be sure if that will work.
Invoke-Command -credential $cred -computername $serverName {$("C:\_Projects\test.ps1")}

WinRM client cannot complete the operation within the time specified

This is what happens when I try and connect to Powershell on my remote machine:
PS C:\Users\Jonathan> Test-WSMan -ComputerName 54.228.XX.XX
Test-WSMan : The WinRM client cannot complete the operation within the time specified. Check if the machine name is val
id and is reachable over the network and firewall exception for Windows Remote Management service is enabled.
At line:1 char:11
+ Test-WSMan <<<< -ComputerName 54.228.XX.XX
+ CategoryInfo : InvalidOperation: (54.228.XX.XX:String) [Test-WSMan], InvalidOperationException
+ FullyQualifiedErrorId : WsManError,Microsoft.WSMan.Management.TestWSManCommand
On my remote computer, I've confirmed that WinRM is running:
PS C:\Users\Administrator> net start winrm
The Windows Remote Management (WS-Management) service is starting.
The Windows Remote Management (WS-Management) service was started successfully.
I've confirmed that it is listening:
PS C:\Users\Administrator> winrm e winrm/config/listener
Listener
Address = *
Transport = HTTP
Port = 5985
Hostname
Enabled = true
URLPrefix = wsman
CertificateThumbprint
ListeningOn = 10.35.XXX.XXX, 127.0.0.1...
and I've chosen to trust all hosts:
PS C:\Users\Administrator> Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force
and finally, I've allowed inbound connections on port 5985. Have I missed something?!
The unfortunate solution for us, was to start from scratch and reinstall windows. After spending a week wasting our time, that fixed it.
The fix in my case was to open an elevated shell and run:
netsh winhttp reset proxy
Note: this worked even though netsh winhttp show proxy showed that my machine was configured for "Direct access (no proxy server)." No reboot was required.

Unable to use PowerShell Enter-PSSession to connect to remote server

I am having problems connecting to a remote server using PowerShell where the remote machine uses a non-default port number. The setup is as follows: I have a virtual host server with several virtual machines. All of these virtual machines have the same IP address but are accessed with a different port, for example:
a.b.c.d:3000
a.b.c.d:3001
etc
So, the PowerShell script I have so far is:
$password = ConvertTo-SecureString "<MyPassword>" -AsPlainText -Force
$cred= New-Object System.Management.Automation.PSCredential ("<Domain\UserName>", $password)
Enter-PSSession -ComputerName <IPAddress> -Port <PortNumber> -Credential $cred
The bits inside the "<>" are specific to the individual machines. When running this script I get the following error:
Enter-PSSession : Connecting to remote server failed
with the following error message : The client cannot connect to the
destination specified in the request. Verify that the service on the
destination is running and is accepting requests. Consult the logs and
documentation for the WS- Management service running on the
destination, most commonly IIS or WinRM. If the destination is the
WinRM service, run the following command o n the destination to
analyze and configure the WinRM service: "winrm quickconfig". For more
information, see the about_Remote_Troubleshooting H elp topic. At
C:\PowerShell\Test7.ps1:25 char:16
+ Enter-PSSession <<<< -ComputerName -Port -Credential $cred
+ CategoryInfo : InvalidArgument: (:String) [Enter-PSSession], PSRemotingTransportException
+ FullyQualifiedErrorId : CreateRemoteRunspaceFailed
Another variant I tried is as follows:
$password = ConvertTo-SecureString "<MyPassword>" -AsPlainText -Force
$cred= New-Object System.Management.Automation.PSCredential ("<Domain\UserName>", $password)
$powershell_uri = "http://<IPAddress>:<PortNumber>"
Enter-PSSession -ConnectionUri $powershell_uri -Credential $cred
but this gave the following error:
Enter-PSSession : Connecting to remote server failed with the
following error message : The client cannot connect to the destination
specified in the request. Verify that the service on the destination
is running and is accepting requests. Consult the logs and
documentation for the WS- Management service running on the
destination, most commonly IIS or WinRM. If the destination is the
WinRM service, run the following command o n the destination to
analyze and configure the WinRM service: "winrm quickconfig". For more
information, see the about_Remote_Troubleshooting H elp topic. At
C:\PowerShell\Test7.ps1:21 char:16
+ Enter-PSSession <<<< -ConnectionUri $powershell_uri -Credential $cred # -ComputerName -Port -Credential
$cred
+ CategoryInfo : InvalidArgument: (http://:/:Uri) [Enter-PSSession],
PSRemotingTransportException
+ FullyQualifiedErrorId : CreateRemoteRunspaceFailed
I have set the TrustedHosts on my local machine (winrm set winrm/config/client #{TrustedHosts=""}) and on the remote machine I have run the "winrm quickconfig" command. On the remote machine I have also run the "winrm create winrm/config/listener?Address=*+Transport=HTTP #{Port=""}" command.
Any assistance on how I can establish a connection within PowerShell to these machines would be greatly appreciated.
On the remote computer:
In: Control Panel\Network and Internet\Network and Sharing CenterMake sure the remote computer is not in the public location, but set it to work or private
Start PowerShell in administrator mode and enter the command:
Enable-PSRemoting
exit
Goto Control Panel -> System and Security ->Windows Firewall and click advanced Settings
Add the ip-range of your managing computer to windows remote management(http-In) both in the private and in the domain inbound rules.
On the managing computer:
Start PowerShell in administrator mode and enter the command:
Set-Item WSMan:\localhost\Client\TrustedHosts -Concatenate remotecomputer.domain.suffix -Force
using your complete remote computer's network path.
This adds the remote computer network name to your trusted hosts.
That should do the trick.