2012r2 (Core) remote management only works when logged on as Administrator

[lewisburgess]

Hi all,

I'm flummoxed so hope someone can point me in the right direction.

 

I've set up 2 new 2012R2 Core DCs, they're running quite nicely and working well. DHCP (load-balanced) is currently on a couple of legacy servers which I want to migrate to the 2 new DCs. The DHCP Server feature is installed and ready to config. I don't actually think this is related to the DHCP server anyway...

 

If I try to connect to the Event Log or DHCP via the MMC from a W7 / W8 desktop with RSAT or 2012 / 2012r2 server elsewhere on the same domain as a Domain or Enterprise Administrator (but not 'administrator'), access is denied. If I log on to the workstation as 'administrator' then it works. Remote Management is configured. I CAN see the event log through Server Manager but not MMC.

 

I've tried:

Turning the firewall off completely

Adding firewall exceptions (see the 2nd reply here)

Disabling local UAC on the server (already off on the client)

Setting my user account with full control in ADSS - Services

Running WinRM -quickconfig on both the server and client (WinRM is definitely running)

Enable-PSRemoting (all set to yes)

 

 

The only thing which works is something which seemingly should only apply to non domain devices: cmdkey /add:RC-SRV-DC1 /user:Administrator /pass:xyz - there's plenty of documentation around remotely managing a non domain joined Hyper-V server in this way.

 

This works, but I shouldn't have to do this from a domain joined device and I want to fix whatever is wrong.

 

I have looked through the event logs on the server and client and can't see anything useful. I can see the authentication from my account being successful on the server's security logs.

 

It's driving me nuts, please, anyone?

 

Many thanks.

Edited December 9, 2015 by lewisburgess

[Roberto]

My first thought, and I know this is a bit lame, is whether or not there might be issues with the domain join. Without wanting to sound like I'm teaching you to suck eggs, can you access domain resources ok from the server? Can you map and view shares on the problem server from other machines when no-one is logged in? If the fundamentals aren't quite right then everything will stem from that.

[Steve21]

If you're using RSAT and Server Manage did you enabled RemoteSM?

 

Configure-SMRemoting.exe –Enable

 

Steve

[lewisburgess]

My first thought, and I know this is a bit lame, is whether or not there might be issues with the domain join. Without wanting to sound like I'm teaching you to suck eggs, can you access domain resources ok from the server? Can you map and view shares on the problem server from other machines when no-one is logged in? If the fundamentals aren't quite right then everything will stem from that.

 

Hi Rob, I managed to: net use x: \\server\share$ from the new DC to a file server without having to auth. I can navigate to \\rc-srv-dc1\c$ from a domain joined workstation when the server is logged out.

 

If you're using RSAT and Server Manage did you enabled RemoteSM?

 

Configure-SMRemoting.exe –Enable

 

Steve

 

Hi Steve, already done

[lewisburgess]

OK, so an update on this...

 

I completely uninstalled RSAT on my W10 workstation, then reinstalled v1.1 which "unofficially" has the DHCP console included.

 

If I load DHCP from Administrative tools, or the MMC then the DHCP snap-in, then connect to rc-srv-dc1 I get access denied.

 

However, if I go via Server Manager -> DHCP -> Right click the server -> DHCP Manager, it DOES work. It's still the same DHCP MMC snap-in, same versions etc. I guess when going via Server Manager, an extra piece of authentication is happening, without needing to explicitly add the server as a trusted host on the client (usually only necessary for a non domain joined device it seems).

 

Oh well, that'll do!