I am trying to bring up a virtual machine that needs to be able to create new sessions (with New-PSSession). The highly engaging about_Remote_Troubleshooting is my constant companion, of course!
After bringing up a basic machine (Win 8.1 Enterprise):
- My company's primary domain is, say,
- We have a development domain
dev.mycompany.comso that developers have a sandbox to play with.
- I added the new VM (named my-vm) to the development domain
- I have a local account on the new VM,
my-vm\msorenswhich is in the Administrators group on the local machine.
Attempting to run just
New-PSSession failed with access denied because of cross-domain issues.
Per the troubleshooting page referenced above:
When a user in another domain is a member of the Administrators group on the local computer, the user cannot connect to the local computer remotely with Administrator privileges.
I am not convinced this is true (due to my inexperience in domain issues) but applying the recipe for that remedy allowed the basic
New-PSSession to work:
New-ItemProperty ` -Name LocalAccountTokenFilterPolicy ` -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ` -PropertyType DWord ` -Value 1
(And that, while less secure, is fine, as it is just a sandbox VM.)
With the above patch in place I could successfully do any of these:
PS> New-PSSession PS> New-PSSession -ComputerName localhost PS> New-PSSession -ComputerName my-vm
However, my actual need is to give the FQDN of the machine:
PS> New-PSSession -ComputerName my-vm.dev.mycompany.com
That fails because of missing credentials. Which brings us to this:
PS> New-PSSession -ComputerName my-vm.dev.mycompany.com -Credential (Get-Credential)
I have tried my local (my-vm) credentials, which resulted in WinRM cannot process the request; no logon servers available.
I have tried my company domain credentials (note that is mycompany.com not the domain the VM is actually on dev.mycompany.com), which resulted in Access is denied.
Is there a way to make this work?