Remote PowerShell command using CredSSP problem

[randle]

Hi,

 

I'm attempting to use PowerShell to run a command on a remote computer. All the WinRM config requirements have been set through GPO and are applying as far as I can tell.

 

I've also configured the client to enable CredSSP to overcome the "double hop" issue seeing as my command is telling the client to look for a file on a server.

 

The problem I'm getting is upon running the script I receive the following error:

[t7s13] Connecting to remote server t7s13 failed with the following error message : The WinRM client cannot process the request. A computer policy does not allow the delegation of the user credentials to the target computer. Use gpedit.msc and look at the following policy: Computer Configuration -> Administrative Templates -> System -> Credentials Delegation -> Allow Delegating Fresh Credentials. Verify that it is enabled and configured with an SPN appropriate for the target computer. For example, for a target computer name "myserver.domain.com", the SPN can be one of the following: WSMAN/myserver.domain.com or WSMAN/*.domain.com. For more information, see the about_Remote_Troubleshooting Help topic.

+ CategoryInfo : OpenError: (t7s13:String) [], PSRemotingTransportException

+ FullyQualifiedErrorId : -2144108125,PSSessionStateBroken

This appears to be a trivial message and obvious what's wrong but running Get-WSManCredSSP on the remote computer I get the following which suggests all is setup appropriately and also confirms GPO configuration.

The machine is configured to allow delegating fresh credentials to the following target(s): WSMAN/myserver.mydomain.internal,WSMAN/*.mydomain.internal

This computer is configured to receive credentials from a remote client computer.

Any Ideas?

[HPlum78]

best I can point you at is this Dustin C. Hatch, Enable PowerShell Remoting with CredSSP using... see if it help.

[randle]

Thanks for that. Helps having all the configuration information in one article as have been researching each part separately and a few things were not configured where they should be. Looks like we're in action now anyway so here comes the easy life.......