Powershell Access Denied Issue - windows

Question

I'm trying to download registry hives from computers in my domain, and I'm testing some commands locally first. I have two machines (VMs) not on the same domain: SRV2K12 and US-TEST. I can run reg.exe save HKLM\SYSTEM \\SRV2K12\Hives\<hostname> (where is the local hostname manually typed) successfully on both machines. However, I ultimately need to run the commands remotely, so I'm using Invoke-Command. On my Win 2012 server, I can use Invoke-Command -computername SRV2K12 -ScriptBlock {reg.exe save HKLM\SYSTEM \\SRV2K12\Hives\<hostname> and it works as expected. On my Windows 7 and Windows 10 machines, it doesn't work. I get this error:
ERROR: Access is denied.
+ CategoryInfo : NotSpecified: (ERROR: Access id denied.: String) []. RemoteException
+ FullyQualifiedErrorId : NativeCommandError
+ PSComputerName : <hostname>
NotSpecified: (:) [], RemoteException
I can run Invoke-Command -ScriptBlock {reg.exe save HKLM\SYSTEM \\SRV2K12\Hives\US-TEST} on the US-TEST Windows 7 machine just fine, and it saves the hive to the remote computer. But when I add the -computername US-TEST attribute (on the Win 7 or 10 machine) it tells me access is denied.
Any ideas how I can get that to work? I have already ran enabled-psremoting -force on those machines and it completes successfully. I also ran Set-item wsman:localhost\client\trustedhosts -value * on both machines. No change.

Answer 1

2-Hop remoting is your problem, as BenH said CredSSP can resolve it but so can a small design change on your part, rather than trying to do the save from the remote host just return the data to your calling computer and do the save from there. Below is one way to do it, but you can get even more efficient and avoid the temp file if you use get-itemproperty instead of reg.exe Also please note that there is a good chance that this will not work when you use invoke-command with the -computername parameter targeting the computer you are running from, -computername needs to be called against a remote machine.
$SB = {
reg.exe save HKLM\SYSTEM "$($env:TMP)\reg"
$tempFile = gc "$($env:TMP)\reg"
return $tempFile
}
$result = Invoke-Command -ScriptBlock $SB -computername COMPUTERNAME
$result | Out-File \\SRV2K12\Hives\US-TEST