I have a user on a Windows Server 2008 machine in domain exampleA.com that I would like to be able to invoke commands remotely using the current user's credentials on a Windows Server 2008 machine in domain exampleB.com using the Invoke-Command cmdlet. Domain exampleB.com trusts exampleA.com, but not the other way round.
I.e., I would like to be able to run Invoke-Command -ComputerName foo.exampleB.com { echo foo } -Authentication Kerberos from host bar.exampleA.com.
When I try this, I get
[foo.exampleB.com] Connecting to remote server failed with the following error message : WinRM cannot process the request. The following error occured while using Kerberos authentication: The network path was not found.
When I do the same thing from a Windows 7 machine in the exampleA.com domain, I get the somewhat more helpful message:
The following error occurred while using Kerberos authentication: The computer foo.exampleB.com is unknown to Kerberos. Verify that the computer exists on the network, that the name provided is spelled correctly, and that the Kerberos configuration for accessing the computer is correct. The most common Kerberos configuration issue is that an SPN with the format HTTP/foo.exampleB.com is not configured for the target.
However, I'm uncertain how to correct this. I would very much like to not have to switch to using Negotiate authentication, since from what I'm reading, that looks like it involves essentially setting up a full PKI (i.e., you can't use a self-signed certificate) just to get WinRM on foo.exampleB.com listening on HTTPS rather than HTTP.
Can this be done, and if so, how?
