2

I need to execute powershell script on remote computer with admin privilegies. I have 2 scripts: client and server. When i start client.ps1 i invoke command on server machine but get access error. I get no error if I use simple code in server.ps1 like write-host "hello".

server.ps1:

 Get-service -ComputerName 'client'

client.ps1:

$ScriptBlockContent = { 
        d:\server.ps1
        }
$remote=New-PSSession -ComputerName 'server'
Invoke-Command $remote -ScriptBlock $ScriptBlockContent
Damir
  • 99
  • 4
  • 11
  • Where is server.ps1 located? Local on your machine? – restless1987 May 14 '17 at 20:24
  • server.ps1 on server, client.ps1 on client. I need to start first client which should invoke remote script on server – Damir May 15 '17 at 06:13
  • This a double hop issue. CredSSP that restless1987 listed is one solution. Here is a [blog post on all of the solutions](https://blogs.technet.microsoft.com/ashleymcglone/2016/08/30/powershell-remoting-kerberos-double-hop-solved-securely/), with Resourced Based Constrained Delegation being the best solution. – BenH May 15 '17 at 14:44

2 Answers2

1

Your client is trying to open D:\server.ps1 and getting access denied. Your script block doesn't even contain the neccesary code to cause powershell to process the contents of the server.ps1 anyway. You have it way to complicated.

You need to properly define a script block:

$scriptblock = { Get-service -ComputerName 'client' }
$remote=New-PSSession -ComputerName 'server'
Invoke-Command $remote -ScriptBlock $scriptblock

Running this command will connect to the machine called 'Server' and tell it to run Get-Service on 'Client' You don't need a client.ps1 and server.ps1 It can all be done from 1 script.

You also need to ensure winrm is running and configured on the server.

Nick
  • 1,783
  • 1
  • 15
  • 18
  • I need 2 scripts. Server and client. Winrm configured and work. And i need to execute script from server by client side... – Damir May 15 '17 at 06:16
1

Your problem is authentication. You have to enable the server to use your credentials for that. You can do this by using CredSSP.

  1. Enable this on your client:

    Enable-WSManCredSSP -Role Client -DelegateComputer ServerNameHere

  2. Enable it on your server:

    Enable-WSManCredSSP -Role Server

  3. Now add this to your Invoke-Command:

-Credential Domain\YourUsername -Authentication CredSSP

A remark on that: With CredSSP, its easy to steal your credentials, if you connect to a compromised system (same as RDP). Be sure that you do this on secure computers only.

restless1987
  • 1,558
  • 10
  • 16