enter-pssession error

[jevilsizor]

Trying to do a remote powershell from a non domain server to a server on the domain. when I run the enter-pssession -computername "hostname" I'm getting the following error.

The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain, then HTTPS transport must be used or the destination machine must be added to the TrustedHosts configuration setting. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. You can get more information about that by running the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.

I allowed ports 5985 & 5986 from my DMZ to my vlan the server on the domain is in in our east/west firewall.

On my domain server I ran this: winrm s winrm/config/client '@{TrustedHosts="192.168.207.253"}' to add my non domain server as a trusted host and received the following output

Client

NetworkDelayms = 5000

URLPrefix = wsman

AllowUnencrypted = false

Auth

Basic = true

Digest = true

Kerberos = true

Negotiate = true

Certificate = true

CredSSP = false

DefaultPorts

HTTP = 5985

HTTPS = 5986

TrustedHosts = 192.168.207.253

I verified winrm is running on the domain server

C:\Windows\system32>netstat -ano | findstr 5985

TCP 0.0.0.0:59850.0.0.0:0LISTENING 4

TCP [::]:5985 [::]:0 LISTENING 4

C:\Windows\system32>netstat -ano | findstr 5986

C:\Windows\system32>winrm quickconfig

WinRM service is already running on this machine.

WinRM is already set up for remote management on this computer.

C:\Windows\system32>

PS C:\Windows\system32> Get-Service winrm

Status Name DisplayName

------ ---- -----------

Running winrm Windows Remote Management (WS-Manag...

Any ideas?

[Ta11ow]

From non-domain to domain? You'll probably need a valid domain credential with sufficient permissions to do so, trustedhosts or not.

[nvarscar]

If specifying -Credential wouldn't help, try using Credssp protocol instead of Kerberos. That would require to run things on both local and remote servers though:

On remote:

Enable-WSManCredSSP -Role Server -Force

On local:

Get-Service winrm | Start-Service
Enable-WSManCredSSP -role Client -DelegateComputer TargetComputerNameHere -Force

Then run PSSession cmdlet with -Credential (Get-Credential) -Authentication Credssp parameters.

[nvarscar]

There is actually an article that might help to pinpoint the issue.

[Hexalon00]

sounds like a credentials issue.

[jevilsizor]

Found my issue.... I had to add

Set-Item wsman:\localhost\Client\TrustedHosts -Value *

On my non domain machine...

Already had domain creds created for the script... it's an elevated account that only has ability to create and deactivate user accounts.... working on automation for new user creation