Skip to main content

Enable PowerShell Remoting with Client Outside of Server's Domain (Trusted Host and Double Hop Issue)

By -
To enable remote powershelling with servers not in the same domain as the client machine you will need to perform the following steps:
Note: Do not allow unencrypted communication for internet use.

On the client PC type:
PS c:\users\root> cd wsman:localhost\Client
PS WSMan:\localhost\Client> Set-Item AllowUnencrypted -Value $true -force
PS WSMan:\localhost\Client> Set-Item TrustedHosts -Value * -force

On the server PC type:
PS c:\users\root> Enable-PSRemoting
Then using regedit set the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service\allow_unencrypted to 0x00000001



To connect from the client type:
PS WSMan:\localhost\Client> New-PSSession -name Server01 -computername boqsource -credential boq\spsetup  -Port 5985
PS WSMan:\localhost\Client> Enter-PSSession Server01

You should be on a command line on your server!

To add Sharepoint commands to your shell type:
[server] c:\> Add-PSSnapin Microsoft.Sharepoint.Powershell
Now you can execute any SP cmdlets!
But wait, you get access denied to the farm :O. This is due to a known issue in the double hop of credentials. My server credentials are different to my client credentials and my Powershell is using my client credentials. The solution is to configure CredSSP authentication.

Here are the steps to enable CredSSP on the server:

1. Login to your server.
2. In powershell type: PS C:\> Enable-WSManCredSSP -Role Server

Here are the steps to enable CredSSP on the client:
1. Enable CredSSP through powershell by typing: PS C:\> Enable-WSManCredSSP -Role Client -DelegateComputer <FQDN of the server>
2. Run "gpedit.msc" drill down: Local Computer Policy > Computer Configuration > Administrative Templates > Credentials Delegation > Allow Delegating Fresh Credentials with NTLM-only.
3. Enable "Allow Delegating Fresh Credentials with NTLM-only" and click "Show" next to "Add servers to list:". Add the server "WSMAN/*" this will add all servers, you can be specific if you wish.
4. Apply the new policy and click Start -> Run -> and type: "gpupdate"


Logging in using CredSSP:
PS C:> Enter-PSSession server -Authentication CredSSP -Credential (Get-Credential)
[server]: PS C:> Add-PSSnapin Microsoft.Sharepoint.Powershell
alternatively, put this into a ps1 script file:

$session = New-PSSession -Name server -ComputerName server -Authentication CredSSP -Credential (Get-Credential)
Invoke-Command -Session $session -ScriptBlock { Add-PSSnapin Microsoft.SharePoint.PowerShell }
Enter-PSsession $session

Now you have full access to the server and Sharepoint cmdlets!! Phew.

Comments

Post a Comment

Popular posts from this blog

WinDBG on 32Bit Applications

By -
On a 64-bit Windows installation is it possible to make both 32-bit and 64-bit dumps of 32-bit processes. The task manager will create a 64-bit dump, which therefore is often what you end up with users sending you. This is not a problem for native executeables since you can still load it in windbg and use the !wow64exts.sw extension to switch into the 32-bit view. However if your process is a .NET process and you want to use SoS to investigate it then you are out of luck, you'll just get the message "SOS does not support the current target architecture." This extension gets around this by hooking/patching functions in dbgeng.dll so that SoS thinks it's working with a 32-bit dump. ** Usage ** Copy soswow64.dll into the "winxp" subfolder of windbg. Then after loading a 64-bit memory dump of a 32-bit process you can simply load the extension: 0:000> .load soswow64 Successfully hooked IDebugControl::GetExecutingProcessorType. Successfully patched DbgEng!X...
Read more

EXCEL Macro - Compare Column A to Column B

By -
Recently a friend asked me to fix a macro that she was working on to compare two columns in Excel and if the cell in Column A did not exist in any cell of Column B, then add it to Column C. You can make check both columns for miss matches by copy/pasting Column B to Column A and vice versa to check both lists and maybe someone will find it handy =) Sub Subset() Dim Acell As Range 'Acell is a range of 1 or more cells Dim Bcell As Range 'Bcell is a range of 1 or more cells Dim Ccell As Range 'Ccell is a range of 1 or more cells Dim Index As Integer 'Index is the current row we are saving to in the Ccell Index = 1 'Start the Index at 1 Dim found As Boolean    'Remove the hidden space 160    Range("A1:A1000").Replace What:=Chr(160), Replacement:="", LookAt:=xlPart    Range("B1:B1000").Replace What:=Chr(160), Replacement:="", LookAt:=xlPart    For Each Acell In Range("A1:A1000")     Acell...
Read more

Powershell Script to Automatically Deploy Sharepoint WSP Packages

By -
Recently I wanted to automate the retraction, removal and deployment of WSP packages in a folder. So I wrote this powershell script. NOTE: There is a bug in the script that returns a false positive. The property $solution.Deployed returns true even though the object is not finished deploying or is locked! I will update this code or if you do then please send your updated code and I will update my post. $packages = (dir *.wsp | Select-Object name) $currentDir = (Get-Location).Path Add-PSSnapin Microsoft.Sharepoint.PowerShell -ErrorAction "SilentlyContinue" Write-Host "Started package installation" foreach ($i in $packages) { Write-Host "Retracting: " + $i $solution = (Get-SPSolution | where-object {$_.Name -eq $i.Name}) Write-Host $solution.Name if ($solution -ne $null) { Write-Host "Solution Found..." if ($solution.Deployed -eq $true) { Write-Host "Uninstalling..." Uninstall-SPSolution -Identity ...
Read more