I have added an AD security group with a user as a member into the Local Administrators Group on a server.

When running a Remote PowerShell script I am getting an Access Denied error, but if I add the AD user directly into the Local Administrator Group the Remote PowerShell Script works fine.

Does anyone have a solution for this issue?

  • Did you restart? Computer group membership needs a restart, or an obscure command to kill the kerberos ticket. – Zoredache May 14 '18 at 15:43
  • 1
    You're looking for the command "klist -li 0x3e7 purge" to reset the Kerberos ticket of the system. However, it doesn't sound like that is the issue here, given how it has been described. – SturdyErde May 14 '18 at 15:46

If you haven't already fully logged out on your management workstation and then logged back in to run your PowerShell remote session, I would do that now, or run the command:

klist -purge

This will reset all Kerberos tokens for the account that you are logged in with, which will refresh all of your group membership information.

Be sure to consider the effects of running your PowerShell session as a different user. EG, if you are logged into your workstation as UserA and you are using UserB credentials for your remote PowerShell session, then running "klist purge" as UserA will not help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.