Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are trying to connect to a remote server via Powershell and use the ActiveDirectory module. When trying to do this locally, everything seems to be fine.

PS C:\Users\bar> Import-Module ActiveDirectory
PS C:\Users\bar> Get-ADUser 'baz'

DistinguishedName : CN=Foo Baz,OU=baz.myhost.com,OU=FooMachine,DC=foo,DC=blah,DC=loc
Enabled           : True
GivenName         : Baz
Name              : Foo Baz
ObjectClass       : user
ObjectGUID        : <some guid>
SamAccountName    : baz
SID               : <more info here>
Surname           : Baz
UserPrincipalName : baz@foo

When we do the samething remotely, we are not so lucky.

C:\> Enter-PSSession -ComputerName 172.1.2.3 -Credential foo\bar
[172.1.2.3]: PS C:\Users\bar\Documents> Import-Module ActiveDirectory
WARNING: Error initializing default drive: 'Unable to contact the server. This
may be because this server does not exist, it is currently down, or it does not
 have the Active Directory Web Services running.'.
[172.1.2.3]: PS C:\Users\bar\Documents> Get-ADUser 'baz'
Unable to contact the server. This may be because this server does not exist, i
t is currently down, or it does not have the Active Directory Web Services runn
ing.
    + CategoryInfo          :
    + FullyQualifiedErrorId : Unable to contact the server. This may be becaus
   e this server does not exist, it is currently down, or it does not have th
  e Active Directory Web Services running.,Microsoft.ActiveDirectory.Managem
 ent.Commands.GetADUser

[172.1.2.3]: PS C:\Users\bar\Documents>

Christopher, we have 2 - 2008 R2 domain controllers running in that domain. The active directory web service is running on both ( "Import-Module ActiveDirectory" works fine on the server console - it is not a domain controller by the way

share|improve this question
add comment

4 Answers

up vote 2 down vote accepted

Would CREDSSP be required in this scenario anyone?

share|improve this answer
add comment

From this link - http://social.technet.microsoft.com/Forums/en/winserverpowershell/thread/094f9dd3-669a-4bea-9f81-f2ea009384d1

To use the AD module, in addition to having a Server 2008 R2 or Windows 7 machine with the AD PowerShell module, if you're not running Server 2008 R2 AD servers, you will need this:

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=008940c6-0296-4597-be3e-1d24c1cf0dda

If you go with a Server 2003 or 2008 AD server with the above add-on, you will still need a Server 2008 R2 or Windows 7 system to be able to utilize the AD module. Using PowerShell remoting, you would be able to use any system with PowerShell v2 installed to call the AD module cmdlets remotely, as outlined here:

http://concentratedtech.com/item/view/id/340

share|improve this answer
    
The AD module is installed on the server and works, but only when you execute it while RDP'd into the box. –  Mark Nov 17 '10 at 21:05
    
What kind of Domain Controllers are you running? I think the part about not being on 2008R2 is more relevant than just the module being installed. –  Christopher Nov 17 '10 at 21:33
    
The domain controller is 2008 R2 as is the server we are remoting into from a Windows 7 box. –  Mark Nov 17 '10 at 21:48
add comment

you connected to the server using an IP address. This way, Kerberos cannot be used to authenticate (which is why you had to use credentials). So when the server tries to authenticate on your behalf, you run into a second hop issue. The server cannot hand over the credentials to a 3rd party, thus you get errors.

Your scenario requires that you connect the client via Kerberos to the server. This is only possible if your client is domain member and you use the server name and not its ip address.

Tobias www.powershell.com

share|improve this answer
    
Even using the server name we still get the same error on the Import-Module ActiveDirectory call. –  Mark Nov 17 '10 at 22:00
add comment

Here is an example of using CredSSP to solve a similar problem. I tested this out, and it works to resolve the AD Web Services error you posted in your question.

To summarize from the article, first you need to enable CredSSP on both the client and server.

On the client: Enable-WSManCredSSP -Role Client -DelegateComputer [computer name] -Force

On the server: Enable-WSManCredSSP -Role Server –Force

Next you need to get or make the credential to connect to the other machine and create a session that uses that credential. Then you can use Invoke-Command to run your PowerShell commands/script in a script block in that new session. Here is a partial example from the article, using the commands from your question:

$credential = Get-Credential -Credential iammred\administrator

$session = New-PSSession -cn SQL1.Iammred.Net -Credential $credential -Authentication Credssp

Invoke-Command -Session $session -ScriptBlock { Import-Module ActiveDirectory; Get-ADUser 'baz' }

However, this interactively asks you for your credentials, so if you want to avoid that, you'll need to do something like this for $credential instead:

$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "DOMAIN\username",$pass;

where $pass is a secure string of the password associated with the account.

share|improve this answer
    
SF likes it when you explain the solution not just link to it –  Drew Khoury Nov 26 '13 at 20:35
    
Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Mark Henderson Nov 26 '13 at 23:03
    
Thanks, I edited the answer to include the gist of the article. –  chustedde Dec 3 '13 at 20:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.