Connecting to remote server failed with the following error message : The user name or password is incorrect

I am trying to connect PowerShell remotely to an Exchange server. This is to a separate AD Domain. (Connecting domainA to domainB) I can connect from domainA to servers on other domains just fine. I receive the following error:

PS Y:\Personal\scripts> $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://server1.domainB.tld/PowerShell/ -Authentication Kerberos -Credential $cred
New-PSSession : [server1.domainB.tld] Connecting to remote server server1.domainB.tld failed with the following error message : The user name or password is incorrect. For more 
information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:12
+ $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri ht ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTransportException
+ FullyQualifiedErrorId : LogonFailure,PSSessionOpenFailed

This isn't specific to this server, I get the same results to two other servers in the same domain.

My username is in UPN format me@domainB.tld If I use domainB\me I get the following error:

PS Y:\Personal\scripts> $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://server1.domainB.tld/PowerShell/ -Authentication Kerberos -Credential $cred
New-PSSession : [server1.domainB.tld] Connecting to remote server server1.domainB.tld failed with the following error message : WinRM cannot process the request. The following 
error with errorcode 0x80090311 occurred while using Kerberos authentication: There are currently no logon servers available to service the logon request.  
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:12
+ $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri ht ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTransportException
    + FullyQualifiedErrorId : AuthenticationFailed,PSSessionOpenFailed

I've also tried connecting to domainB from other domains and receive the same results. I assume there is a permission somewhere that needs to be set, but I'm not sure what.

wsman:\localhost\client\trustedhosts is set to the correct values

I can RDP in with the same credentials no problem, so I know my credentials are valid. I'm also a domain admin. Servers are Windows 2012 R2.

PSRemoting is enabled

[PS] D:\>Enable-PSRemoting -Force
WinRM is already set up to receive requests on this computer.
WinRM is already set up for remote management on this computer.

PSSessionConfiguration

Name          : microsoft.powershell
PSVersion     : 4.0
StartupScript : 
RunAsUser     : 
Permission    : BUILTIN\Administrators AccessAllowed, BUILTIN\Remote Management Users AccessAllowed

Name          : microsoft.powershell.workflow
PSVersion     : 4.0
StartupScript : 
RunAsUser     : 
Permission    : BUILTIN\Administrators AccessAllowed, BUILTIN\Remote Management Users AccessAllowed

Name          : microsoft.powershell32
PSVersion     : 4.0
StartupScript : 
RunAsUser     : 
Permission    : BUILTIN\Administrators AccessAllowed, BUILTIN\Remote Management Users AccessAllowed

Name          : microsoft.windows.servermanagerworkflows
PSVersion     : 3.0
StartupScript : 
RunAsUser     : 
Permission    : NT AUTHORITY\INTERACTIVE AccessAllowed, BUILTIN\Administrators AccessAllowed

In addition, I tried remoting from a server in domainB to server1.domainB and it works fine. So it has something to do with connecting from outside of the domain.

Test auth in IIS works fine

Removing -Authentication Kerberos or using Negotiate also results in errors

wsman trustedhosts - Added FQDN of client to server. Added FQDN and IP of server to client. No change.

What do I need to fix to be able to remote in here?

1
задан 16 May 2017 в 16:22
2 ответа

Если бы это была проблема с привилегиями, в сообщении об ошибке говорилось бы что-то вроде «доступ запрещен».

Почему-то сервер на самом деле не знает вашего пользователя (или PW неверен).

Вы сказали, что пытаетесь подключиться «от домена A к домену B». Похоже, ваш пользователь находится в DomainA, но вы сообщаете серверу, что ваш пользователь находится в DomainB.

Попробуйте подключиться к (скрыто) или me \ domainA .

0
ответ дан 4 December 2019 в 04:56

Вы пытались удалить -Authentication Kerberos из вашего New-PSSession? У меня есть похожие сценарии для управления доверенными серверами обмена доменами, но я не указываю тип аутентификации.

$session = New-PSSession -ConnectionUri "https://mail.server.com/Powershell" -ConfigurationName Microsoft.Exchange -Credential $cred
0
ответ дан 4 December 2019 в 04:56

Теги

Похожие вопросы