Remote Powershell Session - Accessing network share

Nathaniel Miller 21

Scenario: I have 3 computers: Comp1, Comp2, Comp3.

Comp3 has a network share, with a file in it.

I'm trying to write a PowerShell script that will run on Comp1; it will run a Remote PowerShell session on Comp2, which will copy the file from Comp3's share and carry out further commands using the file.

When I run the script, it keeps telling me Access Denied when it tries to access the network share. If I take the contents of the remote script and run it locally on Comp2, it works perfectly.

I've confirmed with "whoami" that it is running under the same account on Comp1 remoting into Comp2, and Comp2 locally (currently using domain admin, for testing purposes).

I even tried taking the PowerShell script and running it on the system using PSExec to launch the PowerShell session on Comp2, with the same result.

Any suggestions appreciated.

1 answer

Rich Matheisen 44,776 Reputation points

2023-05-20T02:05:28.3466667+00:00

Congratulations! You too have discovered the Second Hop Problem.

A succinct explanation is that you can't reuse the credential you used to connect to Comp2 to connect to Comp3.

See here for an explanation and possible solutions: https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/ps-remoting-second-hop?view=powershell-5.1
Please sign in to rate this answer.
Nathaniel Miller 21 Reputation points

2023-05-24T18:34:10.6933333+00:00

Thanks for that pointer. That helped, but not completely.

I tried implementing the "Resource-based Kerberos constrained delegation" solution, as shown example. My early tests worked, but there are a number of systems I'm wanting to run this script on for the "Comp2" place (1 and 3 are same), and it is only working on about half of them. I tried giving it a full day in case there was some replication of permissions that needed to happen, but I can still only get it to work on about half the systems - and some of them changed (didn't work first day but worked second, and vice versa).

I thought maybe when I dropped the entire system list into the "PrincipalsAllowed..." field at once, I might have overflowed it, so I cleared the field and only entered a single system that had not worked either day; but that still isn't helping.

Rich Matheisen 44,776 Reputation points

2023-05-24T20:12:14.0266667+00:00

I don't think I understand why you needed all systems in the "PrincipalsAllowed..." list. You'd only need Comp2.

$AllButComp1AndComp2 = 'Comp3','Comp4','Comp5','Comp6' $Comp2 = Get-AD-Computer -Identity Comp2 ForEach ($comp in $AllButComp1AndComp2){ Get-ADComputer -Identity $comp | Set-ADComputer -PrincipalsAllowedToDelegateToAccount $Comp2 }

Nathaniel Miller 21 Reputation points

2023-05-24T20:41:25.12+00:00

What I was hoping to do was:

$computers = Get-ADComputer -Filter * $computerNames = $computers | Select-Object -ExpandProperty DistinguishedName Set-ADComputer -Identity Comp3 -PrincipalsAllowedToDelegateToAccount $computerNames foreach ($computer in $computers) { <File copy from Comp3's share and operations on that file> } Set-ADComputer -Identity Comp3 -PrincipalsAllowedToDelegateToAccount $null

The operation I'm trying to script needs to be run on all systems (small domain, only a couple dozen systems). I'd hoped to save time by giving it the whole list at once, iterate through the operation, then $null the Delgation at the end.

But that seems to have backfired. Now I can't get it to work on about half the systems, even if I manually do the Set for a single system instead of $computerNames.
Sign in to comment