Remote Powershell scripting and Jenkins not working

Question

I am having an issue running a remote script using Jenkins. I have installed the PowerShell plug-in and can run PowerShell scripts on the local build server, but when I try to run it on a remote server, it fails all the time. I can run the same script outside of Jenkins locally and remotely and it works just fine. My assumption is that there is a security setting I am missing but for the life of me, I can not find it.

Any insight/help would be greatly appreciate it.

The code below runs using PowerShell on the server but not through Jenkins:

$ErrorActionPreference = 'Stop'

# Create a PSCredential Object using the "User" and "Password" parameters 
that you passed to the job
$SecurePassword = 'xxxxxxx' | ConvertTo-SecureString -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential -ArgumentList 'ci-user', $SecurePassword

# Invoke a command on the remote machine.
# It depends on the type of job you are executing on the remote machine as 
to if you want to use "-ErrorAction Stop" on your Invoke-Command.
Invoke-Command -ComputerName xxx.xx.xx.xxx -Credential $cred -ScriptBlock {
    # Restart the W32Time service
    Restart-Service -Name W32Time
}

The error below is what I get when I run it in Jenkins. I am using the same username and password when I run it outside of Jenkins and works:

Connecting to remote server xxx.xx.xx.xxx failed with the 
following error message : WinRM cannot process the request. The following 
error with errorcode 0x8009030d occurred while using Negotiate authentication: 
A specified logon session does not exist. It may already have been terminated. 

 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are 
specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does 
not exist.
  -The client and remote computers are in different domains and there is no 
trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM 
TrustedHosts configuration setting or use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: 
winrm help config. For more information, see the about_Remote_Troubleshooting 
Help topic.
At C:\Windows\TEMP\jenkins3589460126620702793.ps1:12 char:1
+ Invoke-Command -ComputerName xxx.xx.xx.xxx -Credential $cred -ScriptBlock {
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (xxx.xx.xx.xxx:String) [], PSRemoting 
   TransportException
    + FullyQualifiedErrorId : 1312,PSSessionStateBroken

Can you put the command inside of a a try / catch block with `Catch {$error[0]}`? Then provide the output of the error? Also I see that you are using IP address instead of hostname, Don Jones' answer to [this question](https://stackoverflow.com/questions/6587426/powershell-remoting-with-ip-address-as-target) may be relevant. — BenH, Nov 17 '17 at 16:47
I used Don Jones' answer to setup the remote environment which works if I run the script using the PowerShell command line interface outside of Jenkins. The issue is when I run it in Jenkins. I will post the error... — pcroadkill, Nov 17 '17 at 17:22
Is `ci-user` a local or domain account? What happens you use `domain\ci-user` or `servername\ci-user`? — BenH, Nov 17 '17 at 17:45

score 0 · Answer 1 · answered Nov 17 '17 at 17:47

This could be caused by a few different issues:

Are your remote machine and connecting machine on the same domain? If not, verify the domain of your ci-user and retry.

$cred = New-Object System.Management.Automation.PSCredential -ArgumentList 'connectingserver/ci-user', $SecurePassword
Is WinRM enabled on your remote server, is the WinRM service running, are you setup to allow the appropriate remoting? Follow these steps to verify: https://technet.microsoft.com/en-us/library/ff700227.aspx?f=255&MSPPError=-2147217396
Are both the remote and connecting server setup with the same authentication method? You will want to use either Kerberos or CredSSP. I would consider CredSSP only if you are trying to solve the Double-Hop issue.

score 0 · Answer 2 · answered Nov 17 '17 at 19:13

I found the error of my ways but hopefully this answer will help anyone else that encounters it.

The problem was that the user I am using is a local user and it needs to be treated as a workgroup user. So instead of ci-user, I needed to pass it as \ci-user. Once I did this, it works like a charm.

Thank you for all your input.

Remote Powershell scripting and Jenkins not working

2 Answers2