Databases
StackOverflow2013
Postsdbo
POCredSSP PowerShell Session fails when using Kerberos for machine authentication
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POCredSSP PowerShell Session fails when using Kerberos for machine authentication
    primarykey
    data
    text
    <p>We are attempting to use CredSSP authentication for <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ee309365.aspx" rel="nofollow">multi-hop PowerShell remoting</a>, and one of our clients is running into a snag that prevents them from creating PSSessions using CredSSP when specifying the FQDN of the target server. Both server and client are joined to the same domain, and there's nothing fancy going on with disjoint namespaces.</p> <p>In the course of debugging, we've opened up all of the related security options we can think of; in specific:</p> <ul> <li>We've enabled the GP settings to Allow Delegating Fresh Credentials (standard and 'With NTLM only') with the wildcard SPN wsman/*</li> <li>We've enabled the WSMan Trusted Hosts setting with *.domain.com</li> <li>We've (of course) enabled WSMan for CredSSP on the server and the client</li> <li>We've set the LocalAccountTokenFilterPolicy on the server</li> </ul> <p>With all those settings opened up, here's what we get when trying different authentication methods for PSSessions:</p> <ul> <li>Using Kerberos for delegation with explicit domain credentials works fine.</li> <li>Using Negotiate for delegation with explicit domain credentials works fine.</li> <li>Using CredSSP for delegation: <ul> <li>Using domain credentials, connecting to the FQDN of the server, fails with the error <a href="http://msdn.microsoft.com/en-us/library/ms838310.aspx" rel="nofollow">There are currently no logon servers available to service the logon request</a></li> <li>Using domain credentials, connecting to just the hostname of the server, fails with the same error</li> <li>Using credentials for a local account on the server (thus forcing NTLM for server identity verification, I believe), connecting to the FQDN of the server, works fine</li> <li>Using domain credentials, connecting to the IP address of the server (thus forcing NTLM for server identity verification), works fine</li> </ul></li> </ul> <p>So, in short, CredSSP works as long as we're using NTLM for server authentication and fails when we use Kerberos, but Kerberos definitely works fine if we're using Kerberos for delegation as well. How is that possible, and what can we do to make it so that CredSSP+Kerberos works?</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USJamie Macia
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POCredSSP PowerShell Session fails when using Kerberos for machine authentication
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POCredSSP PowerShell Session fails when using Kerberos for machine authentication
      1. USbahrep
      1. VTFavorite
    3. VO
      singulars
      1. POCredSSP PowerShell Session fails when using Kerberos for machine authentication
      1. This table or related slice is empty.
      1. VTUpMod
    1. COany solution about it ?
      singulars
      1. POCredSSP PowerShell Session fails when using Kerberos for machine authentication
      1. USKiquenet
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload