Powershell CREDSSP Problems

Question

I am trying to use CREDSSP on a New Server (Server C)

I have successfully setup credssp on Two Other Servers. (Server A to Server B)

I am now trying to connect from Server A to Server C using CREDSSP, but no matter what I do, I get the following error:

[SERVER_C.domain.edu] Connecting to remote server SERVER_C.domain.edu failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic. + CategoryInfo : OpenError: (SERVER_C.domain.edu:String) [], PSRemotingTransportException + FullyQualifiedErrorId : AccessDenied,PSSessionStateBroken

This is my query that works perfectly from Server A to Server B:

# Setting the Credentials to be used to sign into the Server B. 
    $pass = ConvertTo-SecureString "Password" -asplaintext -force
    $mycred = new-object -typename System.Management.Automation.PSCredential -argumentlist "domain\user.service",$pass
#
#
# The Remote Execution Command. Fully Qualified Domain name is critical since we are using Credssp.
# Credssp is being used to resolve an issue with a double hop authentication issue. Other steps setup on each computer had to be completed before Credssp would work
   Invoke-Command -ComputerName SERVER_B.domain.edu -command { C:\helloWorld.ps1 } -Authentication Credssp  -Credential $mycred

I have double checked everything I can think of between Server C (New Server) and Server B (Old Server) and I cant find any reason why im getting the error.

I know that if I take out the CREDSSP part, The script works, except where a double hop is involved. So the Server is definitely connecting.

I made sure to run the following commands:

Enable-psremoting

Set-ExecutionPolicy -Scope localMachine -ExecutionPolicy RemoteSigned

Enable-WSManCredSSP -Role Client -DelegateComputer '*.reskit.org' –Force 
Enable-WSManCredSSP -Role Server –Force

wsman

Also followed these steps: Use gpedit.msc and look at the following policy: Computer Configuration -> Administrative Templates -> System -> Credentials Delegation -> Allow Delegating Fresh Credentials. Verify that it is enabled and configured with an SPN appropriate for the target computer. For example, for a target computer name "myserver.domain.com", the SPN can be one of the following: WSMAN/myserver.domain.com or WSMAN/*.domain.com. For more information, see the about_Remote_Troubleshooting Help topic.

And as I mentioned, I know Server A is setup correctly, because I run the script above to Server B without issue.

Any suggestions would really be appreciated.

The only thought I have is that Server A and B are running Powershell 3 and Server C is running Powershell 5

Looks like the Issue is related to Server B only having TLS 1.2 an enabled, and Server A having all TLS versions enabled and unfortunately setting Powershell session to use TLS 1.2 does not seem to resolve the problem. I opened a new question to address this quesiton specifically: https://stackoverflow.com/questions/50513033/powershell-credssp-and-tls-1-2 — moore1emu, May 24 '18 at 15:34

score 0 · Answer 1 · answered May 22 '18 at 19:36

I notice that the Enable-WSManCredSSP -Role Client command uses *.reskit.org instead of *.domain.eu.(?)

To me it's not completely clear which commands were run at the server or at the client, but look OK at first sight. I recently configured credssp also to solve the double hop problem, as follows:

On the server:

Enable-WSManCredSSP -Role Server -Force

Get-WSManCredSSP shows: The machine is not configured to allow delegating fresh credentials. This computer is configured to receive credentials from a remote client computer.

On the client:

winrm quickconfig
Enable-WSManCredSSP -role client *.mydomain.com

Get-WSMancredSSP shows: The machine is configured to allow delegating fresh credentials to the following target(s): wsman/*.mydomain.com. This computer is not configured to receive credentials from a remote client computer.

My clientside script starts an explicit remote session via:

$session = New-PSSession -Computer $computerName -Credential $credential -Authentication Credssp

Powershell CREDSSP Problems

1 Answers1