Powershell - Invoke command access denied while not running under domain admin account

Question

I'm using a script to create a folder on a remote server which is a filew server and a RODC. When I run the script from a domain admin user the command complet successfuly. When I run with an account that is on the group that can administer the RODC I got an access denied.

$remotefolder = [scriptblock]::create("New-Item -Path d:\testfolder -type directory -Force ")
Invoke-Command -ComputerName server1 -ScriptBlock $remotefolder

I get this error:

[server1] Connecting to remote server server1 failed with the following error message : Access is denied. 
For more information, see the about_Remote_Troubleshooting Help topic.
    + CategoryInfo          : OpenError: (server1:String) [], PSRemotingTransportException
    + FullyQualifiedErrorId : AccessDenied,PSSessionStateBroken

As it's an RODC there's no local groups that I can add my users that need to run this script.

Is anybody know how I can stop getting this accessdenied ?

Update 12/12: I tried the same script block on a domain member server only and I don't get the access denied message, the folder is created as it should. Any toughs on how I can get this script block running on a RODC without using a Domain admin user ?

Answer 1

You should probably read up on PSSessionConfiguration before you do this, so you understand the implications, starting with

help about_Session_Configurations

First, create a domain group called 'RODC PowerShell Users'. Put yourself in it, wait for replication, log off and on again. Check that you're in this group.

Second, from an elevated shell on the RODC, run this:

Set-PSSessionConfiguration microsoft.powershell -ShowSecurityDescriptorUI

(After the first, time you'll probably want to use -Force but it's useful to see what it's doing.) Hit Y when asked to confirm.

After a few seconds it will display the Permissions UI for http://schemas.microsoft.com/powershell/microsoft.powershell

Click Add, enter your group name in the dialog that appears, and click OK.

In the "Permissions for RODC PowerShell Remoting Access" box, start with Read and Execute. (You may need Write or Full Control, depending on what you want to do.) Click OK.

Then enter Y in the PowerShell window to confirm you want to restart WinRM.

From your remote box, assuming you've already set up remoting on the RODC, you should now be able to run:

Invoke-Command -ComputerName server1 { $env:computername }