Why do I get access denied using Invoke-Command on localhost?

Question

I have valid credentials of a Windows service account stored in $creds and want to use them to access the C:\temp\ directory on another server called remotehost. I use Invoke-Command to execute the same test twice, first on localhost (which leads to denied access) and then on remotehost (which succeeds):

Invoke-Command -ComputerName localhost -Credential $creds -ScriptBlock {
    Test-Path -Path \\remotehost\C$\temp\    # access denied
}

Invoke-Command -ComputerName remotehost -Credential $creds -ScriptBlock {
    Test-Path -Path \\remotehost\C$\temp\    # True
}

Can anyone explain this "access denied"? Why can I successfully connect to remotehost and execute a command there, but I cannot execute the same command from localhost directly?

Just to be sure, I also verified that the connection to localhost works:

Invoke-Command -ComputerName localhost -Credential $creds -ScriptBlock {
    Test-Path -Path C:\temp    # True
}

I am in the Administrators group and the service account is, too. Anyway, how would that explain the access denied in one case but not the other? — dokaspar
– dokaspar, Commented Aug 12, 2024 at 18:31

Doug Maurer · Accepted Answer · 2024-08-12 22:54:34Z

2

What you're experiencing is the double hop issue. You are running a remote command and trying to make another hop to a different remote system. Even though it is your local system, it is still a remote session and thus has the same limitations. You can confirm this by using your remotehost example with a 3rd remote location.

Invoke-Command -ComputerName remotehost1 -Credential $creds -ScriptBlock {
    Test-Path -Path \\remotehost2\C$\temp\
}

You will also get Access Denied

My guess for why this example succeeds is windows is smart enough to know the UNC path actually points at the local system.

Invoke-Command -ComputerName remotehost1 -Credential $creds -ScriptBlock {
    Test-Path -Path \\remotehost1\C$\temp\
}

answered Aug 12, 2024 at 22:54

Doug Maurer

8,9773 gold badges16 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

The Freelancer · Accepted Answer · 2024-08-14 02:53:14Z

-1

Why are you using the network path inside the ScriptBlock? When you use Invoke-Command with a -ComputerName, the command runs on the remote computer, so referencing \remotehost1\C$\temp\ (a network path) within the script block may not be necessary. Instead, you can directly use the local path C:\temp\ within the remote session.

Invoke-Command -ComputerName remotehost -Credential $creds -ScriptBlock {
Test-Path -Path 'C:\temp\'}

answered Aug 14, 2024 at 2:53

The Freelancer

1452 silver badges10 bronze badges

2 Comments

dokaspar Over a year ago

I only did it like that for demonstration purposes.

The Freelancer Over a year ago

Is it working now ?

Collectives™ on Stack Overflow

Why do I get access denied using Invoke-Command on localhost?

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related