Powershell copy item

Question

Hello.

Tell me, there is a script that I run on a remote server. The script connects to the connection broker, pulls out the event and name from the connection log. After this, I must write the data to a file; if I specify the path to the network file in the format "\Scripts\RDP\log.csv" an access error occurs. I run the script and check the script from an account with administrative rights.

New-PSSession -ComputerName rd-cb-1

$csvFilePath = "\Scripts\RDP\log.csv"

if (-not (Test-Path $csvFilePath)) {

"Name" | Out-File  $csvFilePath 

}

$rdGatewayLogName = "Microsoft-Windows-TerminalServices-Gateway/Operational"

$rdGatewayConnectEventID = 302

$startTime = (Get-Date).AddHours(-12)

$events = Get-WinEvent -LogName $rdGatewayLogName

$filteredEvents = $events | Where-Object {

($_.TimeCreated -ge $startTime) -and

($_.Id -eq $rdGatewayConnectEventID -or $_.Id -eq $rdGatewayDisconnectEventID)

}

foreach ($event in $filteredEvents) {

$timestamp = $event.TimeCreated

$formattedDate = $timestamp.ToString("dd.MM.yyyy")

$formattedTime = $timestamp.ToString("HH:mm:ss")

$eventType = if ($event.Id -eq $rdGatewayConnectEventID) { "Connect" } else { "Out" }

$username = $event.Properties[0].Value

$remoteIP = $event.Properties[1].Value

$sessionID = $event.Properties[2].Value

$csvLine = "$formattedDate,$formattedTime,$eventType,$username,$remoteIP,$sessionID"

$csvLine | Out-File $csvFilePath -Append

}

Answer 1

Hi Alex Ch,

This is the "second hop problem" because PowerShell does not delegate credentials by default for security reasons.

Please run Enable-WSManCredSSP on the client to allow delegating credentials. The delegate computer is the FQDN of the RDCB in your case.

Enable-WSManCredSSP –Role Client –DelegateComputer rdcb.domain.com -Force

Then run Enable-WSManCredSSP on the RDCB to allow receiving credentials from clients.

Enable-WSManCredSSP -Role Server -Force

Then you can create a remote session with the "-Authentication Credssp" parameter to run the script from the client.

$cred = Get-Credential 
$mysession = New-PSSession -ComputerName rdcd.domain.com -Credential $cred -Authentication Credssp
Invoke-Command -Session $mysession -ScriptBlock { ... }

You can refer to this link for more details.

https://devblogs.microsoft.com/scripting/enable-powershell-second-hop-functionality-with-credssp/

Best Regards,

Ian Xue

---

If the Answer is helpful, please click "Accept Answer" and upvote it.