Is Enter-PSSession secure when using domain administrator account?

Question

Sometimes I need to open a remote power shell session on workstations for administration. It is convenient for me to do this on a domain controller under a domain administrator account. To do this, I run the command: "Enter-PSSession -ComputerName someWorkstation". But is it safe? What are the consequences if, for example, I connect to a workstation infected with viruses in this way? Can a malware use my session to access other workstations or a domain controller? Can malware steal domain administrator credentials?

Answer 1

Can malware steal domain administrator credentials?

When you do Enter-PSSession, your credentials aren't sent to remote machine. PowerShell remoting uses Kerberos and your credentials are available to KDC only, remote system doesn't see them. Of course, as long as you do not use CredSSP, which will pass your credentials to remote host and is subject for credential compromise.

Can a malware use my session to access other workstations or a domain controller?

no. When you are authenticated to remote server you present session ticket that is intended only for that specific host. No other host would accept it.

Answer 2

Hi,
Glad your problem has been solved
Best wishes
Vicky