Home / server / Questions / 803465
Accepted
Petr Snížek
Asked: 2016-09-17 00:52:00 +0800 CST

PowerShell credSSP session using IP

  • 772

I need to open a Powershell remote session using credSSP authentication from server A to B. However, server A cannot resolve name of B. CredSSP is enabled on A to pass credentials (in "Allow Delegating Fresh Credentials" is enabled WSMAN/xxx.xxx.xxx.xxx) to B, B is configured to receive delegated credentials. Is it possible somehow to open credssp using IP addres instead of hostname/FQDN?

PS C:\Windows\system32> New-PSSession xxx.xxx.xxx.xxx -Authentication Credssp -Credential user
New-PSSession : [xxx.xxx.xxx.xxx] Connecting to remote server xxx.xxx.xxx.xxx failed with the following error message : The WinRM c
lient cannot process the request. A computer policy does not allow the delegation of the user credentials to the target
 computer because the computer is not trusted. The identity of the target computer can be verified if you configure the
 WSMAN service to use a valid certificate using the following command: winrm set winrm/config/service '@{CertificateThu
mbprint="<thumbprint>"}'  Or you can check the Event Viewer for an event that specifies that the following SPN could no
t be created: WSMAN/<computerFQDN>. If you find this event, you can manually create the SPN using setspn.exe .  If the
SPN exists, but CredSSP cannot use Kerberos to validate the identity of the target computer and you still want to allow
 the delegation of the user credentials to the target computer, use gpedit.msc and look at the following policy: Comput
er Configuration -> Administrative Templates -> System -> Credentials Delegation -> Allow Fresh Credentials with NTLM-o
nly Server Authentication.  Verify that it is enabled and configured with an SPN appropriate for the target computer. F
or example, for a target computer name "myserver.domain.com", the SPN can be one of the following: WSMAN/myserver.domai
n.com or WSMAN/*.domain.com. Try the request again after these changes. For more information, see the about_Remote_Trou
bleshooting Help topic.
At line:1 char:1
+ New-PSSession xxx.xxx.xxx.xxx -Authentication Credssp -Credential user
powershell ip-address credentials delegation credssp

1 Answers

  1. Best Answer

    "credssp" needs a SPN setting in group policy "AllowFreshCredentials"

    "The Allow Delegating Fresh Credentials (AllowFreshCredentials) policy setting must be enabled on the WinRM client, and a Service Principal Name (SPN) with the WSMAN prefix must be added to the policy."

    https://msdn.microsoft.com/en-us/library/ee309365%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396

    The syntax of SPN needs FQDN or NetBIOS name not an IP address .

    https://msdn.microsoft.com/en-us/library/ms677601(v=vs.85).aspx

    • 0