While login to windows with local administrator and install xendesktop with AD administrator account, it's successful, below is what i have done:
$adPassword= convertto-securestring "password" -asplaintext -force
$adCredObject = new-object -typename System.Management.Automation.PSCredential -argumentlist "ad.mydomain.com\user",$adPassword
$CurrentProcess = Start-Process -FilePath ".\xendesktop\x64\XenDesktop Setup\XenDesktopServerSetup.exe" -Credential $adCredObject -Wait -PassThru -ArgumentList "/COMPONENTS CONTROLLER,DESKTOPSTUDIO,DESKTOPDIRECTOR,LICENSESERVER,STOREFRONT /NOREBOOT /CONFIGURE_FIREWALL"
But while use puppet automation script(it run with windows system user) to execute install xendesktop with AD administrator account, it's failed, below is what i have done to run 'exec' in puppet(same code as above):
$adPassword= convertto-securestring "password" -asplaintext -force
$adCredObject = new-object -typename System.Management.Automation.PSCredential -argumentlist "ad.mydomain.com\user",$adPassword
$CurrentProcess = Start-Process -FilePath ".\xendesktop\x64\XenDesktop Setup\XenDesktopServerSetup.exe" -Credential $adCredObject -Wait -PassThru -ArgumentList "/COMPONENTS CONTROLLER,DESKTOPSTUDIO,DESKTOPDIRECTOR,LICENSESERVER,STOREFRONT /NOREBOOT /CONFIGURE_FIREWALL"
So the only difference is the succeed one run the above script with local administerator and failed one run with windows system user.The failure message display in the event log is like():
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: MyMachineName
Account Domain: MyDomainName
Logon ID: 0x3e7
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Administrator
Account Domain: MyMachineName
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc000006a
Process Information:
Caller Process ID: 0xd90
Caller Process Name: C:\Program Files (x86)\Puppet Labs\Puppet\sys\ruby\bin\ruby.exe
Network Information:
Workstation Name: MyMachineName
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
I have tried to use runasspc also to execute this installation, but I got same result. Any help would be appreciated.
Related
I'm trying to use Powershell to remotely perform actions within a Windows 10 Hyper-V VM from the Windows 11 host. These actions must:
Be run in the guest OS using Powershell 7
Be run in the guest OS without administrator priviledges (runas /trustlevel:0x20000 <cmd> doesn't work for these actions)
Be run in the guest OS synchronously with it's output captured (i.e. usual de-elevation techniques such as scheduled tasks / explorer.exe <cmd> aren't applicable)
While I am able to run non-elevated commands in Powershell 5.1, I am not able to do so using Powershell 7 as, no matter what I try (see below), a user without administrative priviledges isn't able to use the Powershell 7 session configurations.
My hunch is that the Powershell 7 session configurations (which need to be created while running as Administrator) have file permissions which are not accessible to non-administrative users but I've not been able to find the associated files and verify this.
Stuff I have tried is below. Any suggestions much appreciated.
Powershell 5.1
I can execute regular Powershell 5.1 commands using Invoke-Command, New-Session, Enter-Session, etc using:
Invoke-Command -VMName $vmName -Credential $creds -ScriptBlock { $PSVersionTable }
Which shows this command has been executed using PSVersion 5.1:
Name Value
---- -----
WSManStackVersion 3.0
BuildVersion 10.0.19041.1682
PSVersion 5.1.19041.1682
SerializationVersion 1.1.0.1
CLRVersion 4.0.30319.42000
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
PSEdition Desktop
And works regardless of whether or not the user for specified credentials has administrator priviledges in the guest OS. This can be checked using:
Invoke-Command -VMName $vmName -Credential $creds -ScriptBlock { whoami /groups }
Which results in the following when the user is in the Administrator group:
Group Name
=============================================================
Everyone
NT AUTHORITY\Local account and member of Administrators group
BUILTIN\Users
BUILTIN\Administrators
NT AUTHORITY\INTERACTIVE
CONSOLE LOGON
NT AUTHORITY\Authenticated Users
NT AUTHORITY\This Organization
NT AUTHORITY\Local account
NT AUTHORITY\NTLM Authentication
And the following when the user is not in the Administrator group:
Group Name
======================================
Everyone
BUILTIN\Users
NT AUTHORITY\INTERACTIVE
CONSOLE LOGON
NT AUTHORITY\Authenticated Users
NT AUTHORITY\This Organization
NT AUTHORITY\Local account
NT AUTHORITY\NTLM Authentication
Powershell 7
Running Enable-PSRemoting in an elevated Powershell 7 session within the guest OS creates additional session configurations which can be seen using Get-PSSessionConfigration as shown below:
Name : PowerShell.7
PSVersion : 7.3
StartupScript :
RunAsUser :
Permission : NT AUTHORITY\INTERACTIVE AccessAllowed, BUILTIN\Administrators AccessAllowed, BUILTIN\Remote
Management Users AccessAllowed
Name : PowerShell.7.3.0
PSVersion : 7.3
StartupScript :
RunAsUser :
Permission : NT AUTHORITY\INTERACTIVE AccessAllowed, BUILTIN\Administrators AccessAllowed, BUILTIN\Remote
Management Users AccessAllowed
If the user for the specified credentials is in the Administrators group, these configurations can then be used to execute commands in Powershell 7, for example:
Invoke-Command -VMName $vmName -Credential $creds -ConfigurationName PowerShell.7 -ScriptBlock { $PSVersionTable }
Which shows this command has been executed using PSVersion 7.3:
Name Value
---- -----
WSManStackVersion 3.0
OS Microsoft Windows 10.0.19044
PSVersion 7.3.0
SerializationVersion 1.1.0.1
PSRemotingProtocolVersion
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
GitCommitId 7.3.0
Platform Win32NT
PSEdition Core
However, if the user for specified credentials is not in the Administrators group then an error is encountered when executing the same command:
OpenError: Cannot create or open the configuration session PowerShell.7.
Adding User to "Remote Management Users"
Given then PSSession Configurations shown above seem to suggest a user in the Remote Management Users group should have AccessAllowed I have tried adding this group to the user for the specified credentials. This is shown by executing the following command in Powershell 5.1:
> Invoke-Command -VMName $vmName -Credential $creds -ScriptBlock { whoami /groups }
Group Name
======================================
Everyone
BUILTIN\Users
BUILTIN\Remote Management Users
NT AUTHORITY\INTERACTIVE
CONSOLE LOGON
NT AUTHORITY\Authenticated Users
NT AUTHORITY\This Organization
NT AUTHORITY\Local account
NT AUTHORITY\NTLM Authentication
Mandatory Label\Medium Mandatory Level
But results in the same error when executing the command in Powershell 7:
> Invoke-Command -VMName $vmName -Credential $creds -ConfigurationName PowerShell.7 -ScriptBlock { whoami /groups }
OpenError: Cannot create or open the configuration session PowerShell.7.
Adding User/Users group to Powershell.7 Session Configuration
I have tried add the specific user and/or the Users group to the Powershell.7 Session Configuration using:
Set-PSSessionConfiguration -Name PowerShell.7 -ShowSecurityDescriptorUI
But the user for the specified credentials is still unable able to access the configuration:
> Invoke-Command -VMName $vmName -Credential $creds -ConfigurationName PowerShell.7 -ScriptBlock { whoami /groups }
OpenError: Cannot create or open the configuration session PowerShell.7.
Changing Default Session Configuration
I have also tried setting the default (Microsoft.PowerShell) session configuration to PowerShell 7 by using the script shown here which executes correctly and can be verified using the command:
> Get-PSSessionConfiguration -Name Microsoft.PowerShell
Name : Microsoft.PowerShell
PSVersion : 7.3
StartupScript :
RunAsUser :
Permission : NT AUTHORITY\INTERACTIVE AccessAllowed, BUILTIN\Administrators AccessAllowed, BUILTIN\Remote
Management Users AccessAllowed
But commands still seem to be invoked using Powershell 5.1 as shown:
> Invoke-Command -VMName $vmName -Credential $creds -ScriptBlock { $PSVersionTable }
Name Value
---- -----
WSManStackVersion 3.0
BuildVersion 10.0.19041.1682
PSVersion 5.1.19041.1682
SerializationVersion 1.1.0.1
CLRVersion 4.0.30319.42000
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
PSEdition Desktop
Aaaaaaand, now I'm out of ideas. I could possibly move to using Powershell remoting over SSH but this has it's own set of challenges (generating and adding keys, VM being accessible/resolvable on the external network, etc) so I'm really hoping there's a simply solution to the above.
Help me Stackoverflow Kinobi, you're my only hope.
But the user for the specified credentials is still unable able to access the configuration:
Invoke-Command -VMName $vmName -Credential $creds -ConfigurationName PowerShell.7 -ScriptBlock { whoami /groups }
OpenError: Cannot create or open the configuration session PowerShell.7.
I think there is catch, even if you set standard user to be allowed remote access you still need to use an elevated PS console to execute commands.
when I run the command in the console that was open as standard user the command fails with same error you posted, but opening it as Admin worked by specifying standard user credentials, ex.
In VM run:
Enable-PSRemoting
$SessionName = "StandardSession"
Register-PSSessionConfiguration -Name $SessionName -AccessMode Remote
# When the security dialog shows up, add "Users" to list and set "full controll"
Set-PSSessionConfiguration -ShowSecurityDescriptorUI -Name $SessionName -AccessMode Remote
On host system open PS as Admin and run:
# Add VM name to trusted hosts, update this to VM host name
$Domain = "VM_NETBIOS_NAME"
Set-Item -Path WSMan:\localhost\client\TrustedHosts -Value $Domain -Concatenate
# Restart WinRM service for changes to take effect
Restart-Service -Name WinRM
# Enter credentials of standard user account in VM
$creds = Get-Credential
Invoke-Command -ComputerName $Domain -Credential $creds -ScriptBlock { $PSVersionTable } -ConfigurationName "StandardSession"
Although I didn't test these commands exactly but as part of my other setup which works, by using these commands I got pwrshplugin.dll error but you might get different result, which if you get the same can run the following to confirm all plugins are enabled:
Get-Item WSMan:\localhost\Plugin\* | ForEach-Object {
$Enabled = Get-Item "WSMan:\localhost\Plugin\$($_.Name)\Enabled" |
Select-Object -ExpandProperty Value
[PSCustomObject] #{
Name = $_.Name
Enabled = $Enabled
PSPath = $_.PSPath
}
} | Sort-Object -Property Enabled -Descending | Format-Table -AutoSize
Likely an elevated PS on host isn't a solution you seek but keep in mind that there is registry setting in:
HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
Which allows remote access to members of the Administrators group.
This setting is implicitly set by Enable-PSRemoting
This option is needed to avoid UAC.
I think problem is that for Administrators you can disable UAC but you can't disable UAC for standard users in Windows, but remoting requires this option to be set.
Also this registry option exists only for HKEY_LOCAL_MACHINE, there is no equivalent per-user setting in HKEY_USERS to allow remote access to User.
Hopefully this might shade some light or help to troubleshoot issues, sadly I'm unable to make a reproducible example out of my setup.
EDIT:
On host system in an elevated PS I've run:
# note that $creds are standard user creds of a user in VM
Invoke-Command -ComputerName $Domain -Credential $creds -ScriptBlock { $PSVersionTable } -ConfigurationName "CustomSession"
And got an error:
OpenError: [VM-PRO] Connecting to remote server VM-PRO failed with the following error message : <f:WSManFault xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault" Code="2689860592" Machine="VM-PRO"><f:Message><f:ProviderFault provider="CustomSession" path="C:\Windows\system32\PowerShell\7.3.1\pwrshplugin.dll"></f:ProviderFault></f:Message></f:WSManFault> For more information, see the about_Remote_Troubleshooting Help topic.
Copy this path, in my example it's C:\Windows\system32\PowerShell\7.3.1\pwrshplugin.dll
In guest system visit path C:\Windows\system32\PowerShell\7.3.1 and grant write permission to Users group on this directory.
See this: issue for more information.
Then again I run the command and it succeeded:
Invoke-Command -ComputerName $Domain -Credential $creds -ScriptBlock { $PSVersionTable } -ConfigurationName "CustomSession"
Name Value
---- -----
PSVersion 7.3.1
WSManStackVersion 3.0
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSEdition Core
OS Microsoft Windows 10.0.19045
PSRemotingProtocolVersion
Platform Win32NT
SerializationVersion 1.1.0.1
GitCommitId 7.3.1
Of course this works only if you run PS as Admin on host system to run commands as standard user in guest system.
In Azure Devops Server, I have created a group in Deployment Groups. A registration script was created for run in the target server. This is the generated script.
$ErrorActionPreference="Stop";If(-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent() ).IsInRole( [Security.Principal.WindowsBuiltInRole] “Administrator”)){ throw "Run command in an administrator PowerShell prompt"};If($PSVersionTable.PSVersion -lt (New-Object System.Version("3.0"))){ throw "The minimum version of Windows PowerShell that is required by the script (3.0) does not match the currently running version of Windows PowerShell." };If(-NOT (Test-Path $env:SystemDrive'azagent')){mkdir $env:SystemDrive'azagent'}; cd $env:SystemDrive'azagent'; for($i=1; $i -lt 100; $i++){$destFolder="A"+$i.ToString();if(-NOT (Test-Path ($destFolder))){mkdir $destFolder;cd $destFolder;break;}}; $agentZip="$PWD\agent.zip";$DefaultProxy=[System.Net.WebRequest]::DefaultWebProxy;$securityProtocol=#();$securityProtocol+=[Net.ServicePointManager]::SecurityProtocol;$securityProtocol+=[Net.SecurityProtocolType]::Tls12;[Net.ServicePointManager]::SecurityProtocol=$securityProtocol;$WebClient=New-Object Net.WebClient; $Uri='https://go.microsoft.com/fwlink/?linkid=2066756';if($DefaultProxy -and (-not $DefaultProxy.IsBypassed($Uri))){$WebClient.Proxy= New-Object Net.WebProxy($DefaultProxy.GetProxy($Uri).OriginalString, $True);}; $WebClient.DownloadFile($Uri, $agentZip);Add-Type -AssemblyName System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory( $agentZip, "$PWD");.\config.cmd --deploymentgroup --deploymentgroupname "DG-Test" --agent $env:COMPUTERNAME --runasservice --work '_work' --url 'https://devops.MyCompany.com/tfs/' --collectionname 'Col-FRN-Main' --projectname 'T-MyCompany'; Remove-Item $agentZip;
I run the script then PowerShell asks me to Enter authentication type (press enter for PAT), so I enter an accessToken that is generated in Personal Access Token but PowerShell returns Enter authentication type (press enter for PAT).
I could use the accessToken for connecting Team explorer in Visual studio to my DevOps server and connecting agent pool to my DevOps server, but I have trouble connecting deployment agnet.
What's wrong?
When PowerShell asks you to Enter authentication type (press enter for PAT), you are supposed to press enter on your keyboard. Then it will prompt you to enter your Personal Access Token. Follow the prompts and you should be able to connect successfully.
I have an old established codebase that I'm trying to bring up to modern era standards. Most of it is written on Windows using Visual Studio, so I need to have a Windows based build server to use the MSBuild pipeline. I have a mostly working Jenkins CI pipeline that ingests from Github webhooks, and should deploy to a Windows PC on my local network. I've tested that this works from any other user, on my workstation and on the build server. I know Jenkins runs jobs as the "NT AUTHORITY\System" user, and I've used SysInternals PSExec to pop in and setup my ssh keys, and so forth in the past. The problem is during the deploy step; I'm compressing and copying the build output using a PowerShell script, and using New-PSSession, and Copy-Item -ToSession.
I'm using a cred I'm constructing with Get-Credential, user/pass pair, that I've verified as working. All concerned systems are in a simple workgroup, no domain involved.
The New-PSSession command in my deploy.ps1 script fails with the following error:
PS C:\Program Files (x86)\Jenkins\workspace\xxx> .\deploy.ps1
Compressing to C:\Windows\TEMP\tmpEBB2.tmp.zip
New-PSSession: C:\Program Files (x86)\Jenkins\workspace\xxx\deploy.ps1:95
Line |
95 | … $sess = New-PSSession -ComputerName $TargetHost -Credential $cred …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| [205.208.87.185] Connecting to remote server 205.208.87.185 failed with the following error message :
| WinRM cannot process the request. The following error with errorcode 0x8009030d occurred while using
| Negotiate authentication: A specified logon session does not exist. It may already have been
| terminated. Possible causes are: -The user name or password specified are invalid. -Kerberos is
| used when no authentication method and no user name are specified. -Kerberos accepts domain user
| names, but not local user names. -The Service Principal Name (SPN) for the remote computer name and
| port does not exist. -The client and remote computers are in different domains and there is no trust
| between the two domains. After checking for the above issues, try the following: -Check the Event
| Viewer for events related to authentication. -Change the authentication method; add the destination
| computer to the WinRM TrustedHosts configuration setting or use HTTPS transport. Note that computers
| in the TrustedHosts list might not be authenticated. -For more information about WinRM
| configuration, run the following command: winrm help config. For more information, see the
| about_Remote_Troubleshooting Help topic. Other Possible Cause: -The domain or computer name was not
| included with the specified credential, for example: DOMAIN\UserName or COMPUTER\UserName.
Write-Error: C:\Program Files (x86)\Jenkins\workspace\xxx\deploy.ps1:129
Line |
129 | Deploy-ToTargetHost
| ~~~~~~~~~~~~~~~~~~~
| Could not establish session.
I generated that second error when the $sess var fails to populate. This is line 95:
$sess = New-PSSession -ComputerName $TargetHost -Credential $cred
I believe I've heard something about the System user has some restrictions on network access? Is there any way to work around this?
I mean, I can just scp it over if there's no other way to do this, but I really wanted to just have all my shell scripting in pwsh if I could get away with it. Thanks.
[Edit: TL;DR, I suppose I can modify Jenkins to run as a different user, but why isn't it already running like that? This just seems trivially weird to me to install by default on a user with no network access, I guess?]
I ended up running Jenkins as a different user in Windows Services, specifically a "regular" login user. This made it do the deployment successfully.
i have an problem with my script, plz help :3
This script is supposed to get all Server Hostnames from our Server OU. And than get the Used and Free Space of the Servers But when i try to get the server list with the "Get-AdComputer" cmdlet i get errors.
$servers = Get-ADComputer -Filter * -SearchBase "OU=SomeOU, DC=SomeDomain, DC=SomeDomain, DC=SomeDomain" | Select-Object Name
$allDisks = foreach ($server in $servers)
{
Get-WmiObject Win32_LogicalDisk -ComputerName $server -Filter DriveType=3 |
Select-Object #{'Name'='ComputerName'; 'Expression'={$server}},
DeviceID,
#{'Name'='Size'; 'Expression'={[math]::truncate($_.size / 1GB)}},
#{'Name'='Freespace'; 'Expression'={[math]::truncate($_.freespace / 1GB)}}
}
$allDisks |Export-Csv C:\Servers.csv -NoTypeInformation
when i run this i get:
Get-WmiObject : Der RPC-Server ist nicht verfügbar.
In Zeile:5 Zeichen:5
+ Get-WmiObject Win32_LogicalDisk -ComputerName $server -Filter Dri ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [Get-WmiObject], COMException
+ FullyQualifiedErrorId : GetWMICOMException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
i also should add, that if i only run the thing from the first line i get an clean list of all of our servers.
As the error states that RPC server is not available for the one of the servers that you are trying to query. There can be multiple reasons as per the PS Blog:
The remote computer is blocked by the firewall.
Solution: Open the Group Policy Object Editor snap-in (gpedit.msc) to edit the Group Policy object (GPO) that is used to manage Windows Firewall settings in your organization. OpenComputer Configuration, open Administrative Templates, open Network, open Network Connections, open Windows Firewall, and then open either Domain Profile or Standard Profile, depending on which profile you want to configure. Enable the following exception: “Allow Remote Administration Exception” and “Allow File and Printer Sharing Exception“.
Hostname or IP address is wrong or the remote computer is shut down.
Solution: Verify correct hostname or IP address.
The “TCP/IP NetBIOS Helper” service isn’t running.
Solution: Verify that “TCP/IP NetBIOS Helper” is running and set to auto start after restart.
The “Remote Procedure Call (RPC)” service is not running on the remote computer.
Solution: Verify that “Remote Procedure Call (RPC)” is running and set to auto start after restart.
The “Windows Management Instrumentation” service is not running on the remote computer.
Solution: Verify that “Windows Management Instrumentation” is running and set to auto start after restart
So, I dont think there is any code issue there. Kindly check the network firwwall and server side. Also apply a try/catch block and capture the exact server name in the loop to see which server is that causing the issue.
I am just trying to write a script that can remote login with user/pass credentials via Jenkins. I wrote this script that is given below;
$pass = convertto-securestring "SOME_PASSWORD" -asplaintext -force
$mycred = new-object -typename System.Management.Automation.PSCredential -argumentlist "SOME_USERAME",$pass
invoke-command "SOME_COMPUTER_NAME" {get-process} -credential $mycred
After running this script it giving error like;
[SOME_COMPUTER_NAME] Connecting to remote server SOME_COMPUTER_NAME failed with the following error message : WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the
WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet. For more information, see the about_Remote_Troubleshooting Help topic.
+ CategoryInfo : OpenError: (SOME_COMPUTER_NAME:String) [], PSRemotingTransportException
+ FullyQualifiedErrorId : WinRMOperationTimeout,PSSessionStateBroken
Before your question and suggestions; just controlled WinRM service local and remote machines, I enabled PSRemoting and Set-Item TrustedHosts on remote machine.