why remote PowerShell session dose not need username and password? this is very terrible because I feel anybody can connect remotely to my server.

I use negotiate authentication method and server machine is in domain and client machine is in outside the domain.

I use PowerShell version 4 and allow uncrypted traffic.

At first I connect VPN then with Enter-PSSession connect remote to server machine.

  • Your VPN required authentication. At that point you already authenticated. You wouldn't be able to connect if you didn't connected to the VPN first. – Ramhound Feb 20 '15 at 13:37
  • Thanks for response, but very similar tools like remote desktop need authentication again and I can restrict who can connect VPN and who can use remote desktop separately. but remote PowerShell session does not required authentication and it is very dangerous. – sorosh_sabz Feb 21 '15 at 8:26
  • How is the VPN configured? Do you authenticate with Active Directory, or a separate account? What accounts are authorized on the server - domain only, or do you also have local accounts? Really though, you're this worried about security and yet you "allow unencrypted traffic"? – Iszi Mar 5 '15 at 15:32

Your PSSession will use the credentials of the currently loged on user.

If you are going through Remote Access Server in 2012R2 or similar (assumption based on PowerShell 4 being the 2012R2 flavour) and connected at logon, it's most likely your domain credentials being used to establish the session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.