Powershell – How to persist credentials in a remote Powershell session

powershellremote-accesswindows-server-2012-r2

I have an Azure File Share and would like to use this from my Azure VMs – after persisting the credentials on the VMs with cmdkey and mounting with net use. This was tested by running these commands in a local Powershell session on Windows Server 2012 R2 .

But I need to add this step to an Azure deployment script. An Azure Powershell script runs from my laptop, connects to the Azure subscription and builds the VMs from scratch, using a lot of variables.

Figured out to use Invoke-Command to pass the variables from the Azure Powershell script to a remote Powershell session on the newly created VM.

$Session = New-PSSession -ConnectionUri $Uri -Credential $DomainCredential

$ScriptBlockContent = { 
Param ($Arg1,$Arg2,$Arg3)
cmdkey /add:$Arg1 /user:$Arg2 /pass:$Arg3}

Invoke-Command -Session $Session -ScriptBlock $ScriptBlockContent -ArgumentList ($Share,$AccountName,$Key)

And the error:

PS C:\> Invoke-Command -Session $Session -ScriptBlock $ScriptBlockContent -ArgumentList ($Share,$AccountName,$Key)
CMDKEY: Credentials cannot be saved from this logon session.

Replaced with cmdkey /list to check the syntax, and there's no error.

PS C:\> Invoke-Command -Session $Session -ScriptBlock $ScriptBlockContent
Currently stored credentials:
* NONE *

Had a similar issue (and couldn't fix it) with the Windows Update PowerShell Module (Invoke-WUInstall), that runs just fine on a local Powershell session on the VM, but doesn't update when started via remote Powershell.

Any way to get around this one ?

Best Answer

Due to how Windows handles authentication it is not possible to use CMDKEY to set credentials via a remote PowerShell session, it has to be done interactively when using CMDKEY.

To quote Don Jones from a thread looking for an answer similar to yours:

That's a limitation of the Cmdkey command – not really a PowerShell thing. But it's related to the way Remotig handles credentials. The remote session doesn't actually get a credential, it gets a delegated ticket, so there's no token to actually save. That's all by design, and not something you can reconfigure.

Related Topic