PowerShell Invoke-Command remotely using a share

Question

I am trying to install software (.exe) with PowerShell remotely on another computer. I have now:

Invoke-Command -Authentication Credssp -Credential $cred -ComputerName "TargetComputer01" -ScriptBlock {Start-Process -FilePath $args[0] -ArgumentList ('/log "{0}" /quiet /norestart' -f $args[1]) -Wait -PassThru -Verb RunAs} -ArgumentList @($Installer, $LogPath)

This does not work, no errors, no log file, no installed software. So I have no idea why it is not working. I use Credssp because the installer is located on a share. When I place the installer somewhere on the TargetComputer01, it is working with a session, see:

Invoke-Command -Session $session -ScriptBlock {Start-Process -FilePath $args[0] -ArgumentList ('/log "{0}" /quiet /norestart' -f $args[1]) -Wait -PassThru -Verb RunAs} -ArgumentList @($Installer, $LogPath)

Any idea why the first command with Credssp is not working??

---

Yes I also have enabled Credssp with those commands. It seems that my script does run succesfully on TargetComputer01 (Windows Server 2012) but did not run succesfully on TargetComputer02 (Windows Server 2008 R2). The PowerShell versions are the same, and all other configuration is also the same (e.g. firewall settings).

I found however a way to get it working with a PSSession, see the following code:

$cred = Get-Credential -UserName "domain\username" -Message "Enter your credentials"
$session = New-PSSession -ComputerName "TargetComputer02" -Credential $cred -Authentication Credssp

Invoke-Command -Session $session -ScriptBlock {
    param
    (
        $Installer, $LogPath
    )
    Start-Process -FilePath $Installer -ArgumentList ('/log "{0}" /quiet /norestart' -f $LogPath) -Wait -PassThru -Verb RunAs
} -ArgumentList @($Installer, $LogPath)

I am not sure why the other Invoke-Command without the session but with Credssp does not work on Windows Server 2008 R2, but the above code works on both Operating Systems! :)

Answer 1

Have you actually enabled CredSSP on the two computers? See the Enable-WSManCredSSP command.

On the client computer, or the computer you're running the script on, you need to set it to delegate credentials to the target computer:

Enable-WSManCredSSP -role Client -DelegateComputer "TargetComputer01"

You should verify this was set up properly by going into gpedit.msc -> Computer Configuration -> System -> Credentials Delegation. “Delegating fresh credentials” should now be enabled, and when you open up the details for it, TargetComputer01 should show up like “WSMAN/TargetComputer01”

And now on the receiving computer:

Enable-WSManCredSSP -role Server

Also make sure you run Enable-PSRemoting on TargetComputer01.

Let me know if this works for you!