Questions[credssp](server)

I'm using a domain laptop to remotely manage a bunch of Hyper-V Server 2016, also joined to this domain. But since a recent domain change, I came across an issue with one server.

I can open Hyper-V manager, add the faulty server and get the list of VMs. Even the preview of the VM screen is showing when it's running.

But whenever I try connecting to a VM, I get the error with CredSSP stating (approximative translation from French, see exact error message here):

"An authentication error occured, requested function cannot be provided" blablabla.

I already tried to add the registry key on the Hyper-V Server:

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /f /v AllowEncryptionOracle /t REG_DWORD /d 2

But it's still not working.

Since I'm in a domain, I looked at the GPO, but the "Encryption Oracle Remediation" does not show in the GPO manager.

Strange thing, I can connect and manage VMs without any problem on another server also running Hyper-V Server 2016 (those 2 servers are in a different subnet).

The VMs are running Ubuntu Server 20.04 if it matters.

Any idea on how to fix this please?

EDIT: both servers are up to date.

I need to enable credSSP authentication remotely via PowerShell remoting. When running:

enable-wsmancredssp -role client -delegatecomputer fqdn -force`

I got this error:

Access is denied. 
+ CategoryInfo          : InvalidOperation: (:) [Enable-WSManCredSSP],  nvalidOperationException
+ FullyQualifiedErrorId : WsManError,Microsoft.WSMan.Management.EnableWSManCredSSPCommand
+ PSComputerName        : xxx.xxx.xxx.xxx

Same error occurs even when executing "get-wsmancredssp"

When I connect to the server via rdp and run the command it runs fine. Is there some policy which prevents enabling this remotely?

I need to open a Powershell remote session using credSSP authentication from server A to B. However, server A cannot resolve name of B. CredSSP is enabled on A to pass credentials (in "Allow Delegating Fresh Credentials" is enabled WSMAN/xxx.xxx.xxx.xxx) to B, B is configured to receive delegated credentials. Is it possible somehow to open credssp using IP addres instead of hostname/FQDN?

PS C:\Windows\system32> New-PSSession xxx.xxx.xxx.xxx -Authentication Credssp -Credential user
New-PSSession : [xxx.xxx.xxx.xxx] Connecting to remote server xxx.xxx.xxx.xxx failed with the following error message : The WinRM c
lient cannot process the request. A computer policy does not allow the delegation of the user credentials to the target
 computer because the computer is not trusted. The identity of the target computer can be verified if you configure the
 WSMAN service to use a valid certificate using the following command: winrm set winrm/config/service '@{CertificateThu
mbprint="<thumbprint>"}'  Or you can check the Event Viewer for an event that specifies that the following SPN could no
t be created: WSMAN/<computerFQDN>. If you find this event, you can manually create the SPN using setspn.exe .  If the
SPN exists, but CredSSP cannot use Kerberos to validate the identity of the target computer and you still want to allow
 the delegation of the user credentials to the target computer, use gpedit.msc and look at the following policy: Comput
er Configuration -> Administrative Templates -> System -> Credentials Delegation -> Allow Fresh Credentials with NTLM-o
nly Server Authentication.  Verify that it is enabled and configured with an SPN appropriate for the target computer. F
or example, for a target computer name "myserver.domain.com", the SPN can be one of the following: WSMAN/myserver.domai
n.com or WSMAN/*.domain.com. Try the request again after these changes. For more information, see the about_Remote_Trou
bleshooting Help topic.
At line:1 char:1
+ New-PSSession xxx.xxx.xxx.xxx -Authentication Credssp -Credential user

In attempting to create a PowerShell script using remoting I ran into what I believe is the double-hop problem. In that article, Perriman gives a succinct description of the problem as well as the specific steps to resolve the issue (almost trivial if you know the commands, but for someone less familiar like myself, that information was invaluable!).

I ran Enable-WSManCredSSP Server on my Win7 server without incident, but attempting to run Enable-WSManCredSSP Client –DelegateComputer <FQDN of the server> on my Win7 client generated this error:

Enable-WSManCredSSP : The client cannot connect to the destination specified
in the request. Verify that the service on the destination is running and
is accepting requests.
Consult the logs and documentation for the WS-Management service running
on the destination, most commonly IIS or WinRM. If the destination
is the WinRM service, run the following com mand on the destination
to analyze and configure the WinRM service: "winrm quickconfig".

Running winrm quickconfig confirmed my server was running WinRM:

WinRM already is set up to receive requests on this machine.
WinRM already is set up for remote management on this machine.

And Get-WSManCredSSP confirmed my server was ready to accept credentials from a client:

The machine is not configured to allow delegating fresh credentials.
This computer is configured to receive credentials from a remote client computer.

I also found Boessen's article on WinRM wherein he describes general WinRM setup and found one tidbit to get a useful data point in diagnosis; this command run on the client uses the winrs tool to remotely access the server:

winrs -r:http://<FQDN of my server>:5985 -u:<myDomain>\msorens "dir c:\"

That command returned the expected result, the contents of the root directory on the server, without incident, confirming that my FQDN is correct and that WinRM is enabled.

Boessen indicates port 5985 is the default for Win7; this command run on the server confirms a value of 5985:

get-item wsman:\localhost\listener\listener*\port

The question: Why am I unable to execute the Enable-WSManCredSSP command on the client side?

2011.06.07 Update

I found a solution to the above question: invoking Enable-PSRemoting, advertised to configure a computer to receive remote commands, allowed the Enable-WSManCredSSP on the client to work successfully! Curious, but its man page indicates it does a number of different actions, so I assume one of those inadvertantly did what I needed.

But then I reached another roadblock when I attempted to use CredSSP authentication. Here is the command:

Invoke-Command { Write-Host "hello, world" } -computername $serverName `
-credential $testCred  -Authentication Credssp

And here is the response:

Connecting to remote server failed with the following error message:
The WinRM client cannot process the request. A computer policy does not allow
the delegation of the user credentials to the target computer. Use gpedit.msc
and look at the following policy: Computer Configuration
-> Administrative Templates -> System -> Credentials Delegation
-> Allow Delegating Fresh Credentials.  Verify that it is enabled and
configured with an SPN appropriate for the target computer. For example,
for a target computer name "myserver.domain.com", the SPN can be one of
the following: WSMAN /myserver.domain.com or WSMAN/*.domain.com.
For more information, see the about_Remote_Troubleshooting Help topic.

I verified the settings just as this remarkably helpful error message suggested, and it looks to me like it is configured properly.

The new question: What does this remote connection attempt with CredSSP fail?

In answering please keep the following in mind: Let me dispell in advance any notion that I know what I am doing here, any appearance to the contrary notwithstanding.:-) Windows admin is not my area of expertise!