Double Hop...

-
Ran into an issue where I needed to "double-hop" from one PSSession to another.

This led to an investigation into how to set up CredSSP

My issue resolved around getting System Center Orchestrator to run some PowerShell which reports back the number of users currently on our VPN server.

I followed the awesome posts from * where they suggest to run a PSSession onto the localhost (in my case Orchestrator) rather than to run PowerShell.  This is cool unless you then want to PSSession onto another box, in my case my VPN box to run some more PowerShell!

The post does briefly mention setting up WSManCred - too briefly ;)

Anyways on the first hop machine you need to run (as Administrator) the PowerShell - replace *.domain.com with you domain name - or for tighter security replace with the FQDN of the target server.

PS C:\Enable-WSManCredSSP Client -DelegateComputer *.domain.com

And on the second hop computer...

PS C:\Enable-WSManCredSSP Server -Force

At any time you can check the WSManCredSSP configuration using

 PS C:\Get-WSManCredSSP

 Now you just need to change how you create a PSSession...

1.  Create credentials of a user with correct permissions on the target...

$username = "domain\useraccount"
$password = ConvertTo-SecureString "MySecretPassword" -AsPlainText -Force
$creds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $username, $password

2. Create a new PSSession using those creds and authentication method as CredSSP

    $session = New-PSSession -ComputerName myserver.domain.com -Authentication CredSSP -Credential $creds

 Hope that helps.

Comments

Post a Comment

Popular posts from this blog

PXE booting, MDT and 802.1x

-
Image
Oh dear. We implemented site wide 802.1x when we moved. This has caused numerous issues which we are still tracking down and killing with fire. Again "only-when-we-needed-it" struck as we had a new starter and need to build a machine. Ah.   No PXE.  However thankfully we were able to make a bootable USB using 802.1x and get our build working again from MDT in our 802.1 environment. Here's how we did it.   Caveats:  I'm assuming you know MDT and how PXE works. We use Computer certificates as the 8021x auth method. 802.1x is working in our environment GPO is used to start the wired 802.1x service on built machines. GPO is used to configure the network profile to use 802.1x What you need Get a USB stick to take your WinPE 4GB may be enough Make sure you are running an up to date working MDT installation! Create a machine certificate which has a long expiry date, you don't want to be making USB WinPE images every month!! Export the machine ...
Read more

NetScaler VPX and Exchange 2010

-
Image
From the title you can guess that we have Exchange 2010 (SP1 CU6 - with Hotfix for EVault) and we are using NetScaler VPX to load balance the services.  I used the excellent document from Citrix to configure the NetScalers (we have two in active/active - sort of using VMACs to split the traffic RPC to one, HTTP(S) and SMTP to the other). However I found a document from Microsoft which points out that there is "significant performance penalty" if we configure incorrect persistence for EAS.  The Microsoft document is here: http://technet.microsoft.com/en-us/library/ff625248.aspx This put us in a pickle and no mistake.  This is because in a NetScaler persistence is per vServer.  We have one vServer for HTTPS as we have one IP address for all HTTP traffic.  This vServer would then deal with all HTTPS traffic including OWA,ECP,EWS,RPC over HTTPS and EAS.  OWA requires cookie based persistence, this is also the method the Citrix doc...
Read more

Security Policy 1001

-
We had an annoying warning showing every 5 minutes on our Read Only Domain Controllers.  This didn't affect service but meant we were losing our logs of important events (should the have occurred) "Security policy cannot be propagated. Security Configuration Server (in services.exe) is not ready. This is probably in system reboot. Policy will be tried again in the next propagation." Source: SceCli Event: ID 101 We tracked this down to a GPO which was populating the local Administrators group. Obviously a Domain Controller has no local users or groups so this was causing the issue. Ensuring that the GPO did not apply to the Domain Controllers - yes the GPO was linked at the root! fixed the issue. It is strange that we did not see the warnings on our main Domain Controllers only on the Read Only DC's as this would have affected all DCs the same (I would have thought)
Read more