1

I have an application which requires a website to be able to make an HTTP call which turns on and logs in to an Azure VM. I am trying to do this with a PowerShell Azure Function. I can successfully turn the VM on/off with the function, using:

$secpasswd = ConvertTo-SecureString $env:SP_PASSWORD -AsPlainText -Force;
$mycreds = New-Object System.Management.Automation.PSCredential ($env:SP_USERNAME, $secpasswd)
Add-AzureRmAccount -ServicePrincipal -Tenant $env:TENANTID -Credential $mycreds;
$context = Get-AzureRmContext;
Set-AzureRmContext -Context $context;
# Start VM
Start-AzureRmVM -ResourceGroupName myResourceGroup -Name  myDevice | Out-String

But I'm getting permission denied errors when trying to log into the VM. I have tried the following methods:

$password = ConvertTo-SecureString "myPassword" -AsPlainText -Force
$cred= New-Object System.Management.Automation.PSCredential ("myUsername", $password )

#Enter-PSSession -ConnectionUri https://<public_ip> -Credential $cred -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck) -Authentication Negotiate

and

$Server="<public_ip>"
$User="myUsername"
$Password="myPassword"
cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
mstsc /v:$Server

When logging in with the standard Remote Desktop GUI, I also need to dismiss the certificate prompts. What do I need to do to log in automatically using an Azure Function?

The VM is running Windows 10.

EDIT: I've set up the ports, made a local certificate and made sure that WinRM is setup for remote management on the VM, and also that it's listening on HTTPS. However, when I try the command on my local machine:

Enter-PSSession -ComputerName 52.166.161.93 -Credential $cred -UseSSL -SessionOption $so

I get the error:

Enter-PSSession : Connecting to remote server 52.166.161.93 failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is acce pting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.

EDIT: I have verified that the port is open and accessible from the Azure Function using

New-Object Net.Sockets.TcpClient "<public-ip>", 5986
  • Are you able to try connecting from another VM inside the Azure vNet, this would prove whether or not it is a firewall issue. Also you don't mention, have you checked your NSG? – Sam Cogan Jan 25 '18 at 14:40
  • I've checked all the firewalls and there's no problem there, NSG etc. I think the problem is the certificate, as RM VMs (I think) need to have a certificate from an Azure Key vault as opposed to being allowed to be generated by the VM. At present I'm trying to push a certificate from a Key vault to the VM but getting: "List vaultCertificates contains repeated instances of (https://<certificate_url>, my), which is disallowed. ErrorCode: InvalidParameter" errors, but I'm working on that. – Loz Jan 25 '18 at 14:47
  • If your providing the -SkipCACheck -SkipCNCheck flags then it should not be a problem to use the self signed cert that gets issued. I am generally able to use PS Remoting to a brand new VM deployed to Azure, with no changes, so long as firewall and NSG rules are in place. – Sam Cogan Jan 25 '18 at 15:06
  • @Loz Do you check this blog, you only need configure a self-signed certificate. – Shui shengbao Jan 26 '18 at 8:20
  • @Loz I suggest you could test in your local firstly, please ensure you could access with the command Enter-PSSession -ComputerName 52.166.161.93 -Credential $cred -UseSSL -SessionOption $so. – Shui shengbao Jan 26 '18 at 8:21
1

Firstly, have you made sure that your NSG rules allow inbound WINRM traffic to that machine?

Also, your Enter-PsSession command is wrong. Your -connectionURI should just be the public IP or name of the machine, no https, and then you need to use the -useSSL flag.

1

I could never get Invoke-Command to work for the Azure RM VM. The working solution in the end, now successfully implemented, is using Invoke-AzureRmVMRunCommand within an Azure Automation account. Note for interested parties: At present, Azure Powershell Functions only support AzureRM version 1, which does not support Invoke-AzureRmVMRunCommand (even as an imported module), but Azure Automation works very well.

0

You should enable winrm service on your Azure VM, also, if you want to login from Azure function, you should set winrm service listen on 5986(https). Http is not working.

First, you should open port 5986 on VM firewall and Azure NSG.

Secondly, you need create a cert.

Thirdly, configure WinRM to listen on 5986.

More information about this please refer to this blog.

  • Hi, I've edited the ask to reflect what I've tried :) – Loz Jan 25 '18 at 11:22
  • Hi, do you close the VM, I test in my lab, port 5986,5985,3389 is closed. – Shui shengbao Jan 26 '18 at 8:18
0

With your credential, specify the VM name as part of the username. i.e. if your machine name is vm1 and your user is myusername your credential would look as follows.

$cred= New-Object System.Management.Automation.PSCredential ("vm1\myUsername", $password )

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.