Powershell – add-computer cmdlet cached password question

Well, I finally figured that out. Set-MailboxFolderPermission appears newly in SP1. For RTM version, the solution is in Remove-MailboxFolderPermission and then re-assign the permissions with Add-MailboxFolderPermission.

This MSDN article shows how to configure WinRM for multi-hop support which also addresses making connections when Kerberos is not an option. Brief summary below.

Windows Remote Management (WinRM) supports the delegation of user credentials across multiple remote computers. The multi-hop support functionality can now use Credential Security Service Provider (CredSSP) for authentication. CredSSP enables an application to delegate the user's credentials from the client computer to the target server.

CredSSP authentication is intended for environments where Kerberos delegation cannot be used. Support for CredSSP was added to allow a user to connect to a remote server and have the ability to access a second-hop machine, such as a file share.

Specifically, the section in the article pertaining to the Registry Entry / Group Policy Setting AllowFreshCredentialsWhenNTLMOnly solved the issue I was having. From the article:

If neither Kerberos authentication nor certificate thumbprints are available, the user can enable NTLM authentication. If NTLM authentication is used, the Allow Fresh Credentials with NTLM-only Server Authentication (AllowFreshCredentialsWhenNTLMOnly) policy must be enabled, and an SPN with the WSMAN prefix must be added to the policy. This setting is less secure than both Kerberos authentication and certificate thumbprints, because credentials are sent to an unauthenticated server.

For more information about the AllowFreshCredentialsWhenNTLMOnly policy, see the policy description provided by the Group Policy editor and KB 951608. The AllowFreshCredentialsWhenNTLMOnly policy is located at the following path: Computer Configuration\Administrative Templates\System\Credentials Delegation.