System Shutdown Error – Fix Restart-Computer Failed to Restart

This MSDN article shows how to configure WinRM for multi-hop support which also addresses making connections when Kerberos is not an option. Brief summary below.

Windows Remote Management (WinRM) supports the delegation of user credentials across multiple remote computers. The multi-hop support functionality can now use Credential Security Service Provider (CredSSP) for authentication. CredSSP enables an application to delegate the user's credentials from the client computer to the target server.

CredSSP authentication is intended for environments where Kerberos delegation cannot be used. Support for CredSSP was added to allow a user to connect to a remote server and have the ability to access a second-hop machine, such as a file share.

Specifically, the section in the article pertaining to the Registry Entry / Group Policy Setting AllowFreshCredentialsWhenNTLMOnly solved the issue I was having. From the article:

If neither Kerberos authentication nor certificate thumbprints are available, the user can enable NTLM authentication. If NTLM authentication is used, the Allow Fresh Credentials with NTLM-only Server Authentication (AllowFreshCredentialsWhenNTLMOnly) policy must be enabled, and an SPN with the WSMAN prefix must be added to the policy. This setting is less secure than both Kerberos authentication and certificate thumbprints, because credentials are sent to an unauthenticated server.

For more information about the AllowFreshCredentialsWhenNTLMOnly policy, see the policy description provided by the Group Policy editor and KB 951608. The AllowFreshCredentialsWhenNTLMOnly policy is located at the following path: Computer Configuration\Administrative Templates\System\Credentials Delegation.

If it was a privileges issue, the error would say something like 'access denied'.

Somehow the server actually doesn't know your user (or the PW is incorrect).

You said that you are trying to connect 'from DomainA to DomainB'. That sounds like your user is located in DomainA, but you are telling the server that your user is located in DomainB.

Try connecting with me@domainA.tld or me\domainA.