Add-WindowsCapability and ubuntu2004.exe(the WSL installer) fails to work under WinRM

Question

I'm trying to write some PowerShell scripts to automate server maintenance routines, through the Attune app(https://www.servertribe.com/comunity-edition/), which utilizes the WinRM protocol.
I found out that both Add-WindowsCapability and ubuntu2004.exe can be run successfully from a local or RDP session of the target Windows machine, but running them from Attune / EnterPSSession remote session through WinRM failed with the following errors:

Add-WindowsCapability with "Access is denied."

ubuntu2004.exe with "Program 'ubuntu2004.exe' failed to run: A specified logon session does not exist. It may already have been terminated."

Our team has discussions about these issues here, but no results. They impose an obstacle to implement a fully unattended solution, please anyone can help us, thanks!

Answer 1

Great thanks to RichMatheisen-8856's detailed analysis and suggestions, we've found a workaround with Windows task scheduler, Add-WindowsCapability and ubuntu2004.exe all worked this way. Here's what we did(all steps are run through WinRM / Servertribe's Attune, aka remotely unattended management):

1. Clear "Users must enter a user name and password to use this computer" and reboot the computer, to make sure a session is logged on at the console, which is required for scheduled tasks with "Run only when user is logged on" option set(which is itself required to run Add-WindowsCapability successfully) $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
   $DefaultUsername = "{win10cred1.user}"
   $DefaultPassword = "{win10cred1.password}"
   Set-ItemProperty $RegPath "AutoAdminLogon" -Value "1" -type String
   Set-ItemProperty $RegPath "DefaultUsername" -Value "$DefaultUsername" -type String
   Set-ItemProperty $RegPath "DefaultPassword" -Value "$DefaultPassword" -type String
2. Create a onetime scheduled task, please see detailed script within the blueprint here . The key to the success of this task is "Run only when user is logged on" and "Run with highest privileges" options. # Run the task 15 seconds after task creation
   $ts = New-TimeSpan -Seconds 15
   $Trigger = New-ScheduledTaskTrigger -Once -At ((Get-date) + $ts) # Run only when user is logged on / Run with highest privileges
   $principal = New-ScheduledTaskPrincipal -UserId "{win10cred1.user}" -RunLevel Highest
   $Action= New-ScheduledTaskAction -Execute "powershell.exe" -Argument "Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0"
   $setting = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
   Register-ScheduledTask -TaskName "Add-WindowsCapability OpenSSH.Server" -Trigger $Trigger -Principal $principal -Action $Action -Settings $setting -Force

The result is that, when scheduled time's up, a window will appear in the console session running the specified command, avoid getting errors compared to run the command directly from WinRM.

Answer 2

What credentials are you using in the Enter-PSSession? IIRC, using the admin credentials on the remote machine should elevate the session.

Answer 3

For the "specified logon session does not exist. It may already have been terminated" problem, is the "ubuntu2004.exe" file in a directory that's in your PATH environment variable? If not, provide the full file path and not just the exe name.