1

I've been trying to setup a Server Code system for hours now and nothing works. I'm guessing the root of the issue is that neither the Win2012R2 server nor the Win8.1 client are part of a domain but I can't believe I'm the first one trying to do that.

So I installed the RSAT tools and started up mmc. I add snap-ins, but when trying to connect to the server's IP the only thing I get are Error 5: Access Denied. I disabled the firewall on both systems, ran winrm quickconfig, I looked around the web and all I could find are posts related to DCOM security, saying to go to Component Services and making sure that the Default Authentication Level is set to Connect, which it is. I tried directly through Server Manager, same thing.

I did find out that I can run MMC to connect to a domain server using runas /netonly /user:Administrator "mmc", but it doesn't work when trying to connect to this non-domain joined server.

Obviously I have to enter credentials somewhere, yet MMC never asks for that, strangely enough. I'm used to always using RDP to remote into servers but can't here since it's Server Core. I can't figure this out.

4 Answers 4

1

I believe that you need to specify user@domain as the username when you use the runas command. Otherwise you are defaulting to your local administrator account.

1
  • While this is true, the core issue here is in the computers not being domain members at all.
    – Massimo
    May 7, 2015 at 22:29
1

I know this is a fairly old question - but since it was bumped to homepage by the site, I'll answer it.

Yes, you can use RSAT tools even if the management system is not on the same domain (and therefore not using the same auth database) as the target system.

This is assuming that you're an administrator with the appropriate rights assigned to 1.) open MMC on the management system and 2.) to actually connect using MMC and make changes to the services on the target system.

Unfortunately, you can't do it directly through MMC, as you can't specify a separate username/password pair in the MMC snap-in itself. However, you can in Server Manager.

Firstly, if the systems are in separate domains, more likely than not (especially if this is the first time the management system is being used to manage the target), the target will not be approved to be connected to by the management system's WinRM service for security. How you get around this is by using a PowerShell command that will add the target system to the management's system's "Trusted Hosts" list.

The command to do this is: Set-Item WSMan:\localhost\Client\TrustedHosts -Concatenate -Value "<put in the client's IP address and/or DNS hostname>"

You can then go into Server Manager on the management system and add in the server through the Manage menu -> Add Servers. Because it's not joined to a domain, you'll have to go into the DNS tab and manually type in the DNS name of the server. After you add it to the Server Manager console, it will attempt a refresh.

This refresh will fail because you haven't specified credentials yet. To do that, go to the All Servers tab on the left sidebar and right click on the server (that, at this point, should have a WinRM Authentication Negotiation error) and click on "Manage as...". Follow the syntax instructions in inputting the username in proper format. For local systems, the format is SYSTEMNAME\username. For domain accounts, it's DOMAINNAME\username or [email protected]. It's important to note that these are your target system credentials that you're entering at the Manage As prompt.

Afterwards, refresh should work. At that point, you can right click and, assuming that the proper roles are found on the server to support that particular tool (i.e. you need the DHCP role on the target server as well as the DHCP RSAT tool on the management system to have the option show up in the right click context menu), you can open the tool from there and it will authenticate properly.

"Slightly" roundabout, yes, but if it's a last resort, it's a good one.

0

In order to use any tool from the RSAT kit on a remote system, both the computer you are using and the one you want to manage need to be part of a domain. Period. There is no way you can remotely manage another computer with RSAT snap-ins if there is nobody to validate your credentials on both systems.

Also, you need to be using an user account which has rights to 1) run applications on your system (in order to actually launch the MMC snap-ins you are using) and 2) manage the service(s) you want to control on the remote system.

1
  • You can use an RSAT tool on a remote system if you're not joined to the domain. You just have to go through a very roundabout method. More info found in my answer. Jul 15, 2019 at 3:17
0

Enable Windows Management (http-In) for all profiles

Set-Item wsman:\localhost\client\TrustedHosts -Concatenate -Force

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .