Powershell - usmt loadstate.exe - CommandNotFoundException - powershell

Question

Im stuck on USMT migration. Here is my code:
$scriptA = "\\PL-HVEZDAP\backup\USMTBin\scanstate.exe \\PL-HVEZDAP\backup /ue:* /ui:$name /o /i:'\\PL-HVEZDAP\backup\USMTBin\miguser.xml' /i:'\\PL-HVEZDAP\backup\USMTBin\migapp.xml' /c"
$scriptB = "\\PL-HVEZDAP\backup\USMTBin\loadstate.exe \\PL-HVEZDAP\backup /ue:* /ui:$name /i:'\\PL-HVEZDAP\backup\USMTBin\miguser.xml' /i:'\\PL-HVEZDAP\backup\USMTBin\migapp.xml' /c"
$scriptA = [scriptblock]::Create($scriptA)
$scriptB = [scriptblock]::Create($scriptB)
Invoke-Command -ComputerName $computer -scriptblock $scriptA
Invoke-Command -ComputerName $remcomputer -scriptblock $scriptB
There is a problem on last row - I get error:
The term '\\PL-HVEZDAP\backup\USMTBin\loadstate.exe' is not recognized as the name of a cmdlet, function, script file,
or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try
again.
+ CategoryInfo : ObjectNotFound: (\\PL-HVEZDAP\ba...n\loadstate.exe:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
but if I run $scriptb = get-process, everything works like charm...
Can somebody help me with this? Thanks a lot.

Answer 1

Looks like a kerberos double-hop problem. Once you connect to a remote computer with Invoke-Command, you can't use any commands that implicitly use your authentication again (this includes cmdlets, executables, and connecting to file shares).
This is a function of how Kerberos is designed. You can use a different type of authentication called CredSSP with Invoke-Command to delegate credentials but this requires some set up on both ends.
Often it's easier to re-think where the pieces are stored and/or executed.
Since you make extensive use of a file share, you might consider not using Invoke-Command to a remote machine and instead executing the backup script locally on the target machine.
One way to do this, while still being able to store the script centrally is to make a scheduled task on the target machine that runs this script. It can even be pushed out via GPO if you're in a domain.
Then you can start the task when you want that code to run.
You can even use Invoke-Command -ComputerName $remcomputer -ScriptBlock { schtasks.exe /Run /TN "My Task" } and that will work.