Powershell invoke-command access is denied error – not a double hop

access-deniedinvoke-commandpowershell

I am building a new network with Server 2016 and a handful of Windows 10 clients. I have run Enable-PSRemoting successfully on all the clients. From the server I run:

Invoke-Command -ComputerName $computer -Scriptblock {'test'}

which results in
[computer] Connecting to remote server failed with the following error message : Access is denied.
+ CategoryInfo: OpenError: (computer:string) [], PSRemotingTransportException
+ FullyQualifiedErrorId: AccessDenied,PSSessionStateBroken

Because I am only having the remote computer process a string I believe this is not related to the common double hop issue I see in the forums.

I can also run WinRM successfully on the client machines:

Test-WSMan $computer

If anyone has insight into other causes of the access denied error I would greatly appreciate some ideas on where to look.

Thanks.

Best Answer

You need to be in Remote management users group on target machine (if it's local account). This will be enough for Invoke-Command access

Related Solutions

Powershell – Invoke-Command failed: WinRM cannot complete the operation

Did you add the remotes to your local trusted host list? If not you can add them via

winrm s winrm/config/client '@{TrustedHosts="RemoteComputer"}'

PowerShell Access is denied. PSRemotingTransportException + FullyQualifiedErrorId : PSSessionStateBroken

From MSDN:

Start Windows PowerShell as an administrator by right-clicking the Windows PowerShell shortcut and selecting Run As Administrator.

The WinRM service is confi gured for manual startup by default. You must change the startup type to Automatic and start the service on each computer you want to work with. At the PowerShell prompt, you can verify that the WinRM service is running using the following command: get-service winrm The value of the Status property in the output should be “Running”.

To configure Windows PowerShell for remoting, type the following command: Enable-PSRemoting –force

In many cases, you will be able to work with remote computers in other domains. However, if the remote computer is not in a trusted domain, the remote computer might not be able to authenticate your credentials. To enable authentication, you need to add the remote computer to the list of trusted hosts for the local computer in WinRM. To do so, type: winrm s winrm/config/client '@{TrustedHosts="RemoteComputer"}' Here, RemoteComputer should be the name of the remote computer, such as: winrm s winrm/config/client '@{TrustedHosts="CorpServer56"}'

You should check if the winrm is running. Also add your remote hosts to the trusted hosts list (or your local machine).

Hope that helps.

Best Answer

Related Solutions

Powershell – Invoke-Command failed: WinRM cannot complete the operation

PowerShell Access is denied. PSRemotingTransportException + FullyQualifiedErrorId : PSSessionStateBroken

Related Topic