0

I have just started working with the remoting features of PowerShell 3.0. My current problem is that I can log in to remote machine "secondmachine" and execute the command

gci "\\thirdmachine\share"

And this works properly. However, logged in to "firstmachine", when I execute the command

invoke-command -ComputerName secondmachine -Credential "mydomain\myusername" -ScriptBlock {gci "\\thirdmachine\share"}

This command prompts for the password, executes, but no files are returned. Also, no errors are returned, either.

Note that this is a cut-down example from a larger script, and the initial symptom was that after $var = gci "\\thirdmachine\share", $var.Length was zero.

If I had admin access to "thirdmachine", then I would look at the audits in the security event log to see what happened, but I don't have that access. How can I troubleshoot this problem? Is there a way for me to see which credentials are being used when the command actually executes on "secondmachine"?

1

What you are doing is basically second-hopping (security delegation) to thirdmachine.

By default this feature is disabled for security reasons but can be enabled on the end point machines using the command

Enable-WSManCredSSP –Role client –DelegateComputer *
Enable-WSManCredSSP –Role server

A more technical explaination can be found here: http://technet.microsoft.com/en-us/magazine/jj853299.aspx

  • Thanks, this takes me in the right direction, and I may accept it as the answer. But I don't have an end to end solution yet, so I'll hold off the acceptance for now. – John Saunders Apr 14 '14 at 16:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.