PowerShell remoting using a remote local account on a computer on the same domain

0

I've made a app in C# that remotly updates the hosts file of the computers on our domain using powershell remoting. It works great but entry level IT Support position in our company do not have their domain accounts part of the admin group on our workstations. They can however use a local admin account. I'm trying to add a 'Connect using a different account' feature but quickly ran into some hurdles. I've fixed all of them but one:

I cannot get it to authenticate using a remote local account and all of my Googling hasn't yielded any solutions.

Here's the code I'm using to update the hosts file:

psInstance.AddScript("Invoke-Command -ComputerName " + computerName + " -ScriptBlock { \"" + 
    hostsTextBox.Text.Replace("\"", "`\"") + "\" | Out-File c:\\windows\\system32\\drivers\\etc\\hosts }" + 
    (differentCredentialsCheckbox.Checked ? "-Credential \"" + computerName + "\\\" -Authentication Negotiate " : ""));

When using different credentials, it fails with the following message:

[COMPUTERNAME] Connecting to remote server COMPUTERNAME failed with the following
error message : WinRM cannot process the request. The following error with error code
0x8009030e occurred while using Negotiate authentication: A specified logon session     
does not exist. It may already have been terminated.  This can occur if the provided
credentials are not valid on the target server, or if the server identity could not    
be verified. If you trust the server identity, add the server name to the
TrustedHosts list, and then retry the request. Use winrm.cmd to view or edit the
TrustedHosts list. Note that computers in the TrustedHosts list might not be
authenticated. For more information about how to edit the TrustedHosts list, run the
following command: winrm help config. For more information, see the
about_Remote_Troubleshooting Help topic.
    + CategoryInfo          : OpenError: (COMPUTERNAME:String) [], PSRemotingTransportException
    + FullyQualifiedErrorId : 1312,PSSessionStateBroken

Now if I understand correctly using a remote local account only works if:

  1. The connection is made using HTTPS however that brings it own set of problems. A certificate would need to be created for each computer the tool is meant to be used and install on our 500+ workstations. Also, the process need to be started over if the technician gets a new computer (which shouldn't happen often but has a non-zero possibility)

  2. The computers trusts each other using TrustedHosts but that too has the same problems as #1.

Note: We are the local IT group working at one of the branch of a multinational company, we do not have access to GPO so we do not have any easy ways of pushing certificates to our workstations. Also, each groups within our branch are secluded on their own VLAN.

Does anyone can think of a way to achieve what I'm trying to do?

powershell
powershell-remoting
asked on Stack Overflow Oct 23, 2014 by Pixy

3 Answers

2

Actually it's not that hard.

I think you read the manual wrong ;-) I can make a similar case work just fine by adding the remote server to the trusted hosts on the client server (the one initiating the session).

You need EITHER https or trusted host. Not both.

To update trusted hosts (overwrites whatever might be in there): winrm s winrm/config/client '@{TrustedHosts="ServerName"}' so you might want to do some string manipulation to add to any existing hosts.

If you get an error in that command, ensure a winrm quickconfig first.

My invovation is simply: Invoke-Command -ComputerName $rmServerName -Credential $rmCred -ScriptBlock $block -ArgumentList $destName -ErrorAction:Stop

This works for me across domains with no SSL setup.

answered on Stack Overflow Aug 28, 2015 by Soeren L. Nielsen • edited Oct 13, 2016 by Jaans
0

You're correct about needing HTTPS and TrustedHosts. One thing you might not be aware of is that the computers probably already have certificates. If there is an enterprise CA set up in the domain, the computers are probably set up for autoenrollment.

Constrained Endpoints

Something else that may work is to create a special Powershell endpoint for this task, and give it a RunAsCredential of the local user. I am not 100% on whether it works with a local user but I think it could.

If you're not familiar, the steps are to use New-PSSessionConfigurationFile to create the session definition, then use RegisterPSSessionConfiguration with that file to register it on the local machine. In the latter call, you can supply a -RunAsCredential and the powershell session will run under those credentials. You can delegate access to non-administrative (domain) users to access this endpoint (use the -ShowSecurityDescriptorUI parameter of Register-PSSSessionConfiguration to make this easy).

This won't require HTTPS nor TrustedHosts.

I have done this before and it definitely works, I just don't know for sure if you can use a local admin for the RunAs user.

If not, you can use a domain account with local admin rights; the helpdesk people won't be authenticating directly as that user so they won't need its credentials.

References

answered on Stack Overflow Oct 23, 2014 by briantist
0

We use custom credentials for one of our tools and rather than using custom credentials in PowerShell we launch a new process using NetOnly credentials.

We do this in C# however you can also just run the application using the runas /netonly /user:localadmin and you're prompted for a password.

answered on Stack Overflow Sep 13, 2016 by David Homer • edited Oct 12, 2016 by Martijn Pieters

User contributions licensed under CC BY-SA 3.0