Powershell Server Network drive

Question

I have a client and a server. The client will call a script like:

#Predefine necessary information
$Username = "Niels"
$Password = "password"
$ComputerName = "192.168.1.51"
$Script = {powershell c:/build/jclbuild2.bat}

#Create credential object
$SecurePassWord = ConvertTo-SecureString -AsPlainText $Password -Force
$Cred = New-Object -TypeName "System.Management.Automation.PSCredential" -ArgumentList $Username, $SecurePassWord

#Create session object with this
$Session = New-PSSession -ComputerName $ComputerName -credential $Cred

#Invoke-Command
$Job = Invoke-Command -Session $Session -Scriptblock $Script 
echo $Job

#Close Session
Remove-PSSession -Session $Session

On the server the jclbuild2.bat will run and access a network drive like \\otherserver\something, it says access denied if I do this command:

cmd.exe /C copy "\\server\file1.pdf" "\\server2\file1.pdf"

How do I access a network drive from a powershell file on a remote server? The user I use with the $username and $password should have access to the network drive.

I think it's a double hop issue, which I don't know how to solve.

Community · Accepted Answer · 2017-04-13 12:13:35Z

2

You can't do this using the default authentication mechanism. You need to use an authentication mechanism that allows you to flow credentials, not just identity. Kerberos is one of these. CredSSP is another that is built into Windows starting from Vista/Server 2008 onwards.

I have experience setting up CredSSP. Note that there is some security risk because the target machine will have access to the credentials as plain text.

To set it up you will need to run two commands (both from an elevated shell). One on the machine you are running the above script on (the client) and another on the target that you will be connecting to via remoting (the server).

Enable-WSManCredSSP -Role Client -DelegateComputer $ComputerName -Force

This enables delegation to $ComputerName from the client (note you may have to use the FQDN). For security reasons you should avoid using the wild card '*' although you might consider using '*.mydomain.int' to enable delegation to all machines on the domain.

On the target server

Enable-WSManCredSSP -Role Server

Then when you create the session use the -Authentication flag

$Session = New-PSSession -ComputerName $ComputerName -credential $Cred -Authentication Credssp

There are questions on ServerFault on setting up CredSSP. There is also a blog post here with additional explanation. This post has troubleshooting tips for some commonly encountered error messages.

edited Apr 13, 2017 at 12:13

CommunityBot

11 silver badge

answered Jul 23, 2014 at 7:28

Mike Zboray

41.1k3 gold badges102 silver badges132 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Niels Over a year ago

I'm getting some WSMAN error. The identity of the targetcomputer cannot be verified as WSMAN-servce.

Mike Zboray Over a year ago

@Niels Which command did it fail on? See this for some additional info. I remember there being quite a bit wrangling with FQDNs when I set this up. You may have to use the FQDN when creating the session as well.

Niels Over a year ago

I fixed it. I had a strange error when I added the -Authentication then I simplified my script and it worked. Thanks !

mjolinor · Accepted Answer · 2014-07-23 07:57:59Z

Another option is to use a delegated session on your server.

Basically, you create a custom remote session that uses the -RunAs parameter to designate the credentials that the session will run under. You can also constrain what scripts and cmdlets can be run in the session and specify who can connect to the session.

In this case, the session would run as the Niels account, and everything done in the session would be under that account authority, regardless of who was connected to the session. From that session, you can now make one hop to another server without needing CredSSP.

This also eliminates the security risk involved in storing that account password in the script file on the client computer.

http://blogs.technet.com/b/heyscriptingguy/archive/2014/04/03/use-delegated-administration-and-proxy-functions.aspx

Collectives™ on Stack Overflow

Powershell Server Network drive

2 Answers 2

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related