Double Hop...
Ran into an issue where I needed to "double-hop" from one PSSession to another.
This led to an investigation into how to set up CredSSP
My issue resolved around getting System Center Orchestrator to run some PowerShell which reports back the number of users currently on our VPN server.
I followed the awesome posts from * where they suggest to run a PSSession onto the localhost (in my case Orchestrator) rather than to run PowerShell. This is cool unless you then want to PSSession onto another box, in my case my VPN box to run some more PowerShell!
The post does briefly mention setting up WSManCred - too briefly ;)
Anyways on the first hop machine you need to run (as Administrator) the PowerShell - replace *.domain.com with you domain name - or for tighter security replace with the FQDN of the target server.
PS C:\Enable-WSManCredSSP Client -DelegateComputer *.domain.com
And on the second hop computer...
PS C:\Enable-WSManCredSSP Server -Force
At any time you can check the WSManCredSSP configuration using
PS C:\Get-WSManCredSSP
Now you just need to change how you create a PSSession...
1. Create credentials of a user with correct permissions on the target...
$username = "domain\useraccount"
$password = ConvertTo-SecureString "MySecretPassword" -AsPlainText -Force
$creds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $username, $password
2. Create a new PSSession using those creds and authentication method as CredSSP
$session = New-PSSession -ComputerName myserver.domain.com -Authentication CredSSP -Credential $creds
Hope that helps.
This led to an investigation into how to set up CredSSP
My issue resolved around getting System Center Orchestrator to run some PowerShell which reports back the number of users currently on our VPN server.
I followed the awesome posts from * where they suggest to run a PSSession onto the localhost (in my case Orchestrator) rather than to run PowerShell. This is cool unless you then want to PSSession onto another box, in my case my VPN box to run some more PowerShell!
The post does briefly mention setting up WSManCred - too briefly ;)
Anyways on the first hop machine you need to run (as Administrator) the PowerShell - replace *.domain.com with you domain name - or for tighter security replace with the FQDN of the target server.
PS C:\Enable-WSManCredSSP Client -DelegateComputer *.domain.com
And on the second hop computer...
PS C:\Enable-WSManCredSSP Server -Force
At any time you can check the WSManCredSSP configuration using
PS C:\Get-WSManCredSSP
Now you just need to change how you create a PSSession...
1. Create credentials of a user with correct permissions on the target...
$username = "domain\useraccount"
$password = ConvertTo-SecureString "MySecretPassword" -AsPlainText -Force
$creds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $username, $password
2. Create a new PSSession using those creds and authentication method as CredSSP
$session = New-PSSession -ComputerName myserver.domain.com -Authentication CredSSP -Credential $creds
Hope that helps.
Comments
Post a Comment