I need to script some routine task to execute remotly from a serverA to many hosts but a couple of them fail to execute the script.

If i execute this:

$cred = Get-Credential myUser
Invoke-Command -ComputerName serverB -ScriptBlock{gci d:\} -Credential $cred

or this:

Test-WSMan -ComputerName ServerB -Credential $cred -Authentication Negotiate

I get the following error

[SeverB] Connecting to remote server ServerB failed with the following error message : WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Negotiate authentication: An unknown security error occurred. Possible causes are: -The user name or password specified are invalid. -Kerberos is used when no authentication method and no user name are specified. -Kerberos accepts domain user names, but not local user names. -The Service Principal Name (SPN) for the remote computer name and port does not exist. -The client and remote computers are in different domains and there is no trust between the two domains. After checking for the above issues, try the following: -Check the Event Viewer for events related to authentication. -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport. Note that computers in the TrustedHosts list might not be authenticated. -For more information about WinRM configuration, run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic. + CategoryInfo : OpenError: (serverB:String) [], PSRemotingTransportException + FullyQualifiedErrorId : -2144108387,PSSessionStateBroken

But when i used test-wsman alone:

Test-WSMan -ComputerName ServerB

wsmid : 
ProtocolVersion : http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd
ProductVendor   : Microsoft Corporation
ProductVersion  : OS: 0.0.0 SP: 0.0 Stack: 3.0

I dont know where the problem could be. I had already tried using enable-psremote, winrm qc, checking firewall settings and user priviledge

  • do you mean enable-psremoting? – Mike Shepard Oct 6 '17 at 14:33
  • also, have you tried adding serverb to trustedhosts (temporarily, as a test)? – Mike Shepard Oct 6 '17 at 14:33
  • @mike shepard yes, i ll edit my question. And also yes i have already donde that – Nico Osorio Oct 7 '17 at 15:21
  • How about using IP address instead of server name ? – Aravinda Oct 8 '17 at 3:28

seems like an issue with exsting spn mapping issue , In powershell you can delete spn account and retry.

setspn -D HTTP/SERVERNAME <domain account>
setspn -D HTTP/SERVERNAME.DOMAINAME.COM <domain account>

if the issue persists, you can check with using ip address (IPv4) instead of server name to bypass Kerberos error.

Source https://serverfault.com/questions/580411/windows-server-manager-kerberos-error-0x80090322


| improve this answer | |

I solved my problem. There is a known issue between Kerberos Autentication, Remote Powershell and Intregation Service (the server is running that app). Info can be found here and here

I have to create an A record DNS to the server (serverB_alias) and set the HTTP spn for this server to the account specifyng the port that wsman tries to connect (5985).

setspn -s http/serverB domain\user
setspn -s http/serverB.domain domain\user
setspn -s http/serverB_alias:5985 domain\user
setspn -s http/serverB_alias.domain:5985 domain\user

Finally, i add to server A trusted host list the alias DNS using:

$curValue = (get-item wsman:\localhost\Client\TrustedHosts).value
set-item wsman:\localhost\Client\TrustedHosts -value "$curValue, serverB_alias"
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.