Running Powershell cmdlet in C# application on IIS across domains

Question

We have to domains: NT1 and NT2.

We have a C# application that calls Powershell cmdlets on Exchange server (domain NT2). It uses credentials of NT2\User.

The excerpt:

using System.Management.Automation;
using System.Management.Automation.Runspaces;
...
var connectionInfo = nw WSManConnectionInfo(
    exchangeUri,
    "http://schemas.microsoft.com/powershell/Microsoft.Exchange",
    new PSCredential(nt2User, password));
connectionInfo.SkipRevocationCheck = true;
connectionInfo.SkipCACheck = true;
connectionInfo.SkipCNCheck = true;

using var runspace = RunspaceFactory.CreateRunspace(connectionInfo);
runspace.Open();
using var pipeline = runspace.CreatePipeline();
pipeline.Commands.AddScript("Set-User -Identity Contoso\Jill -DisplayName Jill");
pipeline.Invoke();

Everything is fine when I simply run this application on my computer (domain NT1).

It stops working when the application is deployed on a server in domain NT1 and hosted on IIS. IIS Application pool is configured with Identity of domain NT1 (NT1\User).

It throws System.Management.Automation.Remoting.PSRemotingTransportException at System.Managemnt.Automation.RemoteRunspace.Open():

Connecting to remote server mail.test.brightfulsolutions.com failed with the following error message: Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.

It seems like IIS Application pool identity user NT1\User and the Powershell intended user NT2\User conflict, but not sure what to do about it.

Any suggestions (code, server configuration) are welcome.

Have you tried to set application pool identity to local system? Besides, did you enable any impersonation?There shouldn't be a conflict between network PS session credential and IIS application pool identity. The error message sounds like the credential that passed to remote server don't have access to the exhange server. So you need to figure out what credential are passed to the server. — Jokies Ding, May 06 '20 at 09:35
Correct credentials are passed and it works with the Local System account running the application pool as you suggest. As I figured, the identity account running the application pool can execute remote Powershell calls when it has local admin rights. — dvitonis, May 12 '20 at 08:02

Running Powershell cmdlet in C# application on IIS across domains

0 Answers0