Questions[winrm](server)

Today I have been totally defeated by this infamous 2012R2 error:

Server Manager could not start the task due to the following error: Failed to open the runspace pool. The Server Manager WinRM plug-in might be corrupted or missing. 

I have repeatedly tried each of the solutions proposed here, here and here.

No luck. There is no single error in the event log. Of cause I can add-remove roles with Powershell or completely wipe this machine. Still I am looking for the normal solution to this simple problem.

Further testing have shown that my bug is repeatable. I have tested on virgin default fully updated Windows Server 2012 R2 Standard installation and was able to reproduce it. Problems start after this statement:

winrm invoke Restore http://schemas.microsoft.com/wbem/wsman/1/config/plugin @{}

Full details are below. Any ideas?

After domain controller upgrade from win2008 R2 to 2012R2 everything worked flawlessly.
[dcdiag /fix /q] showed nothing apart the error below. 
Error happened in a few hours after upgrade (not immediately):
  Source:        Microsoft-Windows-WinRM
  Event ID:      10155
  Level:         Error
  Description:
  The WSMan service failed to read configuration of the following plugin: 
   Microsoft.ServerManager. 

  The error received was -2144108144: %%-2144108144 
   The WS-Management service cannot process the request. Configuration for plugin: "Microsoft.ServerManager" is corrupted. This plugin needs to be reconfigured or deleted. Use the following command to delete a plugin configuration 

   winrm delete http://schemas.microsoft.com/wbem/wsman/1/config/plugin?Name=xyz 

   Or use the following command to restore default plugin configuration.  Note that all external plugins will be unregistered during this restore operation. 

   winrm invoke Restore http://schemas.microsoft.com/wbem/wsman/1/config/plugin @{}.

   User Action 
   Make sure this plugin configuration is valid.

I have run in the CMD window:
  winrm invoke Restore http://schemas.microsoft.com/wbem/wsman/1/config/plugin @{}

Then after server reboot Server Manager stopped working correctly with the error mentioned in the 1st paragraph.

Config and Windows details are below.

PS C:\> winrm quickconfig
WinRM service is already running on this machine.
WinRM is already set up for remote management on this computer.

PS C:\> winrm enumerate winrm/config/listener
Listener
    Address = *
    Transport = HTTP
    Port = 5985
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = 127.0.0.1, 192.168.30.6, ::1

PS C:\> (Get-WmiObject -class Win32_OperatingSystem).Caption
Microsoft Windows Server 2012 R2 Datacenter

PS C:\> [System.Environment]::OSVersion.Version
Major         : 6
Minor         : 3
Build         : 9600
Revision      : 0
MajorRevision : 0
MinorRevision : 0

I am attempting to execute the following Powershell command:

Enter-PSSession -ComputerName localhost

The server in use is running Windows Server 2008 R2 SP1 64-bit. The server is on a domain. I am logged in under my domain administrator account. The powershell session was started as Administrator.

I'm getting the following error message from powershell itself:

PS C:\Users\Daniel> Enter-PSSession -Computername localhost
Enter-PSSession : Connecting to remote server localhost failed with the following error message : The client cannot
connect to the destination specified in the request. Verify that the service on the destination is running and is
accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most
commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to
analyze and configure the WinRM service: "winrm quickconfig". For more information, see the
about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ Enter-PSSession -Computername localhost
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (localhost:String) [Enter-PSSession], PSRemotingTransportException
    + FullyQualifiedErrorId : CreateRemoteRunspaceFailed

PS C:\Users\Daniel>

Using Event Viewer, I am able to hunt down the following two errors under Applications and Services Logs > Microsoft > Windows > Windows Remote Management > Operational

General:
    The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig".
Detail:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
        <System>
            <Provider Name="Microsoft-Windows-WinRM" Guid="{A7975C8F-AC13-49F1-87DA-5A984A4AB417}" /> 
            <EventID>161</EventID> 
            <Version>0</Version> 
            <Level>2</Level> 
            <Task>7</Task> 
            <Opcode>0</Opcode> 
            <Keywords>0x400000000000000a</Keywords> 
            <TimeCreated SystemTime="2016-08-17T23:10:40.766446000Z" /> 
            <EventRecordID>56814</EventRecordID> 
            <Correlation ActivityID="{0190DC40-F800-0000-3291-5DB0DAF8D101}" /> 
            <Execution ProcessID="7888" ThreadID="7912" /> 
            <Channel>Microsoft-Windows-WinRM/Operational</Channel> 
            <Computer>FNZAS2.flow.net.nz</Computer> 
            <Security UserID="S-1-5-21-2875926586-1071052228-4104636349-1151" /> 
        </System>
        <EventData>
            <Data Name="authFailureMessage">The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig".</Data> 
        </EventData>
    </Event>   

General:
    WSMan operation CreateShell failed, error code 2150858770
Detail:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
        <System>
            <Provider Name="Microsoft-Windows-WinRM" Guid="{A7975C8F-AC13-49F1-87DA-5A984A4AB417}" /> 
            <EventID>142</EventID> 
            <Version>0</Version> 
            <Level>2</Level> 
            <Task>10</Task> 
            <Opcode>2</Opcode> 
            <Keywords>0x4000000000000002</Keywords> 
            <TimeCreated SystemTime="2016-08-17T23:10:40.766446000Z" /> 
            <EventRecordID>56816</EventRecordID> 
            <Correlation ActivityID="{0190DC40-F800-0000-2F91-5DB0DAF8D101}" /> 
            <Execution ProcessID="7888" ThreadID="7912" /> 
            <Channel>Microsoft-Windows-WinRM/Operational</Channel> 
            <Computer>FNZAS2.flow.net.nz</Computer> 
            <Security UserID="S-1-5-21-2875926586-1071052228-4104636349-1151" /> 
        </System>
        <EventData>
            <Data Name="operationName">CreateShell</Data> 
            <Data Name="errorCode">2150858770</Data> 
        </EventData>
    </Event>

I've been trying quite a few things to verify everything. Here's some more longform powershell output to show some of my working so far.

PS C:\Users\Daniel> $PSVersionTable.PSVersion

Major  Minor  Build  Revision
-----  -----  -----  --------
4      0      -1     -1


PS C:\Users\Daniel> winrm quickconfig
WinRM service is already running on this machine.
WinRM is already set up for remote management on this computer.

PS C:\Users\Daniel> Enable-PSRemoting
WinRM Quick Configuration
Running command "Set-WSManQuickConfig" to enable remote management of this computer by using the Windows Remote
Management (WinRM) service.
 This includes:
    1. Starting or restarting (if already started) the WinRM service
    2. Setting the WinRM service startup type to Automatic
    3. Creating a listener to accept requests on any IP address
    4. Enabling Windows Firewall inbound rule exceptions for WS-Management traffic (for http only).

Do you want to continue?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): A
WinRM is already set up to receive requests on this computer.
WinRM is already set up for remote management on this computer.

Confirm
Are you sure you want to perform this action?
Performing the operation "Set-PSSessionConfiguration" on target "Name: microsoft.powershell SDDL:
O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD). This lets selected users remotely run Windows PowerShell
commands on this computer.".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): A

PS C:\Users\Daniel> Enable-PSRemoting -force
WinRM is already set up to receive requests on this computer.
WinRM is already set up for remote management on this computer.

PS C:\Users\Daniel> winrm get winrm/config
Config
    MaxEnvelopeSizekb = 500
    MaxTimeoutms = 60000
    MaxBatchItems = 32000
    MaxProviderRequests = 4294967295
    Client
        NetworkDelayms = 5000
        URLPrefix = wsman
        AllowUnencrypted = true [Source="GPO"]
        Auth
            Basic = true [Source="GPO"]
            Digest = true
            Kerberos = true
            Negotiate = true
            Certificate = true
            CredSSP = true [Source="GPO"]
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        TrustedHosts = *
    Service
        RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
        MaxConcurrentOperations = 4294967295
        MaxConcurrentOperationsPerUser = 1500
        EnumerationTimeoutms = 240000
        MaxConnections = 300
        MaxPacketRetrievalTimeSeconds = 120
        AllowUnencrypted = false
        Auth
            Basic = true [Source="GPO"]
            Kerberos = true
            Negotiate = true
            Certificate = false
            CredSSP = true [Source="GPO"]
            CbtHardeningLevel = Relaxed
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        IPv4Filter [Source="GPO"]
        IPv6Filter [Source="GPO"]
        EnableCompatibilityHttpListener = false
        EnableCompatibilityHttpsListener = false
        CertificateThumbprint
        AllowRemoteAccess = true [Source="GPO"]
    Winrs
        AllowRemoteShellAccess = true [Source="GPO"]
        IdleTimeout = 7200000
        MaxConcurrentUsers = 10
        MaxShellRunTime = 2147483647
        MaxProcessesPerShell = 25
        MaxMemoryPerShellMB = 1000
        MaxShellsPerUser = 30

PS C:\Users\Daniel> winrm e winrm/config/listener
Listener [Source="GPO"]
    Address = *
    Transport = HTTP
    Port = 5985
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = null

PS C:\Users\Daniel> get-service WinRM

Status   Name               DisplayName
------   ----               -----------
Running  WinRM              Windows Remote Management (WS-Manag...

PS C:\Users\Daniel> winrm get wmicimv2/Win32_Service?Name=WinRM
Win32_Service
    AcceptPause = false
    AcceptStop = true
    Caption = Windows Remote Management (WS-Management)
    CheckPoint = 0
    CreationClassName = Win32_Service
    Description = Windows Remote Management (WinRM) service implements the WS-Management protocol for remote management.
 WS-Management is a standard web services protocol used for remote software and hardware management. The WinRM service l
istens on the network for WS-Management requests and processes them. The WinRM Service needs to be configured with a lis
tener using winrm.cmd command line tool or through Group Policy in order for it to listen over the network. The WinRM se
rvice provides access to WMI data and enables event collection. Event collection and subscription to events require that
 the service is running. WinRM messages use HTTP and HTTPS as transports. The WinRM service does not depend on IIS but i
s preconfigured to share a port with IIS on the same machine.  The WinRM service reserves the /wsman URL prefix. To prev
ent conflicts with IIS, administrators should ensure that any websites hosted on IIS do not use the /wsman URL prefix.
    DesktopInteract = false
    DisplayName = Windows Remote Management (WS-Management)
    ErrorControl = Normal
    ExitCode = 0
    InstallDate = null
    Name = WinRM
    PathName = C:\Windows\System32\svchost.exe -k NetworkService
    ProcessId = 936
    ServiceSpecificExitCode = 0
    ServiceType = Share Process
    Started = true
    StartMode = Auto
    StartName = NT AUTHORITY\NetworkService
    State = Running
    Status = OK
    SystemCreationClassName = Win32_ComputerSystem
    SystemName = FNZAS2
    TagId = 0
    WaitHint = 0

PS C:\Users\Daniel> winrm id
IdentifyResponse
    ProtocolVersion = http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd
    ProductVendor = Microsoft Corporation
    ProductVersion = OS: 6.1.7601 SP: 1.0 Stack: 3.0
    SecurityProfiles
        SecurityProfileName = http://schemas.dmtf.org/wbem/wsman/1/wsman/secprofile/http/basic, http://schemas.dmtf.org/
wbem/wsman/1/wsman/secprofile/http/spnego-kerberos

PS C:\Users\Daniel> Enter-PSSession -ComputerName localhost
Enter-PSSession : Connecting to remote server localhost failed with the following error message : The client cannot
connect to the destination specified in the request. Verify that the service on the destination is running and is
accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most
commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to
analyze and configure the WinRM service: "winrm quickconfig". For more information, see the
about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ Enter-PSSession -ComputerName localhost
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (localhost:String) [Enter-PSSession], PSRemotingTransportException
    + FullyQualifiedErrorId : CreateRemoteRunspaceFailed

PS C:\Users\Daniel>    

I've also tried restarting the WinRM service, as well as restarting the whole server. Still getting the same errors.

It's easy to miss. To my (inexpert) eye, the second error message in the Event Viewer seems like it could be meaningful:

WSMan operation CreateShell failed, error code 2150858770

I've found this error code on another question on Server Fault, but there's no answers.

I've managed to find a similar issue here. I have tried the MaxFieldLength and MaxRequestBytes suggested by Arthur_Li, but this didn't resolve the problem for me.

That error code looks like it might be in decimal, so I've tried converting that to hex and searching for the hex code instead, and didn't find anything much that the base error code didn't already turn up.

I'm completely stumped at this point. I've set up PowerShell Remoting on other servers before without issues like this.

Once piece of advice I have received is: "Stop using 2008 R2. Upgrade to something more recent." We were planning to do that sometime in the next six months anyway. But it's not something we're going to be able to act on until, probably, the end of September at the earliest.

I can work around this by logging into the machines, uploading the deployment scripts and package myself, and running them manually. But that kind of defeats the point of having an automated deployment process in the first place.

Any assistance would be greatly appreciated.

UPDATE #1

Attempting to delete and then restore a default listener for WinRM.

PS C:\Users\Daniel> winrm delete winrm/config/listener?address=*+transport=HTTP
WSManFault
    Message
        ProviderFault
            WSManFault
                Message = WS-Management does not allow changes to a listener created automatically by the group policy.
The policy "Allow Auto Configuration of listeners on WinRm service" would need to be set to "Not Configured" in order to
 create a new listener for same Address and Transport or to modify an already existing listener.

Error number:  -2144108406 0x8033808A
Cannot change GPO controlled setting.

I went in here to gpedit.msc. Turns out that the "Allow Auto Configuration of listeners on WinRm service" has been unhelpfully renamed to "Allow remote server management through WinRM". I set this to "Not configured" and tried again.

PS C:\Users\Daniel> winrm delete winrm/config/listener?address=*+transport=HTTP
PS C:\Users\Daniel> winrm create winrm/config/Listener?Address=*+Transport=HTTP
ResourceCreated
    Address = http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
    ReferenceParameters
        ResourceURI = http://schemas.microsoft.com/wbem/wsman/1/config/listener
        SelectorSet
            Selector: Address = *, Transport = HTTP

PS C:\Users\Daniel> winrm e winrm/config/listener
Listener
    Address = *
    Transport = HTTP
    Port = 5985
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = 10.10.90.6, 127.0.0.1, ::1, fe80::100:7f:fffe%11, fe80::5efe:10.10.90.6%13

PS C:\Users\Daniel> Enter-PSSession -ComputerName localhost
Enter-PSSession : Connecting to remote server localhost failed with the following error message : WinRM cannot process
the request. The following error with errorcode 0x80090322 occurred while using Negotiate authentication: An unknown
security error occurred.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or
use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more
information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ Enter-PSSession -ComputerName localhost
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (localhost:String) [Enter-PSSession], PSRemotingTransportException
    + FullyQualifiedErrorId : CreateRemoteRunspaceFailed

PS C:\Users\Daniel>

On that topic, here's the current configuration of my GPO for WinRM

Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Client

• Allow Basic authentication: Enabled
• Allow CredSSP authentication: Enabled
• Allow unencrypted traffic: Enabled
• Disallow Digest authentication: Not configured
• Disallow Kerberos authentication: Not configured
• Disallow Negotiate authentication: Not configured
• Trusted Hosts: Not configured

Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Server

• Allow remote server management through WinRM: Not configured (Note: This was set to 'Enabled' in the examples prior to this update)
• Allow Basic authentication: Enabled
• Allow CredSSP authentication: Enabled
• Allow unencrypted traffic: Enabled
• Specify channel binding token hardening level: Not configured
• Disallow WinRM from storing RunAs credentials: Not configured
• Disallow Kerberos authentication: Not configured
• Disallow Negotiate authentication: Not configured
• Turn On Compatibility HTTP Listener: Not configured
• Turn On Compatibility HTTPS Listener: Not configured

The error message has changed. When I jump into Event Viewer, I now get the following two errors. Note that they've both changed. The first changed dramatically, the second less dramatically.

General:
    Omitted for brevity. Same as per the "authFailureMessage" in the details below.
Detail:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
        <System>
            <Provider Name="Microsoft-Windows-WinRM" Guid="{A7975C8F-AC13-49F1-87DA-5A984A4AB417}" /> 
            <EventID>161</EventID> 
            <Version>0</Version> 
            <Level>2</Level> 
            <Task>7</Task> 
            <Opcode>0</Opcode> 
            <Keywords>0x400000000000000a</Keywords> 
            <TimeCreated SystemTime="2016-08-18T00:37:41.784323600Z" /> 
            <EventRecordID>61452</EventRecordID> 
            <Correlation ActivityID="{0190DC40-F800-0000-79D1-5DB0DAF8D101}" /> 
            <Execution ProcessID="7888" ThreadID="8116" /> 
            <Channel>Microsoft-Windows-WinRM/Operational</Channel> 
            <Computer>FNZAS2.flow.net.nz</Computer> 
            <Security UserID="S-1-5-21-2875926586-1071052228-4104636349-1151" /> 
        </System>
        <EventData>
            <Data Name="authFailureMessage">WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Negotiate authentication: An unknown security error occurred. Possible causes are: -The user name or password specified are invalid. -Kerberos is used when no authentication method and no user name are specified. -Kerberos accepts domain user names, but not local user names. -The Service Principal Name (SPN) for the remote computer name and port does not exist. -The client and remote computers are in different domains and there is no trust between the two domains. After checking for the above issues, try the following: -Check the Event Viewer for events related to authentication. -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport. Note that computers in the TrustedHosts list might not be authenticated. -For more information about WinRM configuration, run the following command: winrm help config.</Data> 
        </EventData>
    </Event>

General:
    WSMan operation CreateShell failed, error code 2150858909
Details:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
        <System>
            <Provider Name="Microsoft-Windows-WinRM" Guid="{A7975C8F-AC13-49F1-87DA-5A984A4AB417}" /> 
            <EventID>142</EventID> 
            <Version>0</Version> 
            <Level>2</Level> 
            <Task>10</Task> 
            <Opcode>2</Opcode> 
            <Keywords>0x4000000000000002</Keywords> 
            <TimeCreated SystemTime="2016-08-18T00:37:41.784323600Z" /> 
            <EventRecordID>61454</EventRecordID> 
            <Correlation ActivityID="{0190DC40-F800-0000-7CD1-5DB0DAF8D101}" /> 
            <Execution ProcessID="7888" ThreadID="8116" /> 
            <Channel>Microsoft-Windows-WinRM/Operational</Channel> 
            <Computer>FNZAS2.flow.net.nz</Computer> 
            <Security UserID="S-1-5-21-2875926586-1071052228-4104636349-1151" /> 
        </System>
        <EventData>
            <Data Name="operationName">CreateShell</Data> 
            <Data Name="errorCode">2150858909</Data> 
        </EventData>
    </Event>

UPDATE #2

Attempting to clear out WinRM settings and then restore the defaults.

Powershell output at: pastebin.com/E5wgXE1q

Underlying Windows Event logs are the same as those generated in Update #1.

UPDATE #3

Using Mer's winrm/config output as a guide, I've gone through my local machine group policy objects and reset everything back to be 'Not Configured' This gives me a winrm/config output that matches Mer's.

I still wasn't able to get through, however. Tried the same clear-out/reset steps followed in Update #2 just to be safe, and that didn't work either.

Powershell output at pastebin.com/EuzyDR6d

Output in Event Log is the same as for Update 2.

Will try a server restart to see if that makes a difference.

UPDATE #4

Server restart didn't fix. Still getting the same error message as per Update #2.

UPDATE #5

Okay. This is nuts.

All of the problems above are happing on a server we'll call AS2.

I just jumped over to the AS1 server, and set up remote powershell. Just to make sure I'm not going insane.

• AS1: Enter-PSSession localhost > Successful
• AS1: Enter-PSSession AS2 > Successful
• AS2: Enter-PSSession localhost > Failure
• AS2: Enter-PSSession AS1 > Successful

Earlier, I was having problems getting from AS2 into any server. But somewhere along the line I fixed that. Now it's just the localhost on AS2 that's the problem.

This feels completely nuts. Why can't AS2 remote to itself, when it is clearly happy to accept incoming connections, and it can make outgoing connections fine?

UPDATE #6

Okay, new information: CredSSP authentication does work. It seems to be specifically something to do with Negotiate authentication on this server that is broken.

I may be able to use this as the basis of a workaround for what I'm trying to do. That still wouldn't explain why Negotiate seems to be broken on this server though.

I have a network with windows 2003, 2008 and 2008r2 servers. I have a powershell script that I wrote to patch a local machine using the "Microsoft.Update" com objects. (Similar to Windows Update PowerShell Remoting.) My script works wonderfully locally but I'd like to use it's functions remotely as I have a fair number of servers to manage. In that case it falls down (similarly to that other post, which wasn't solved).

I was however able to narrow the failure down to two methods on a particular class.

(New-Object -ComObject "Microsoft.Update.Session").CreateUpdateDownloader()
(New-Object -ComObject "Microsoft.Update.Session").CreateUpdateInstaller()

If you run these in a powershell locally as an admin, you'll have no issues. If you try to use invoke-command (or enter-session, or winrs) you'll get the following error. (This is testing with localhost, but any host will do. I've also tried with different authentication methods such as credssp and kerberos.);

PS C:\> Invoke-Command -ComputerName localhost -ScriptBlock { (New-Object -ComObject "microsoft.update.session").createUpdateDownloader()}
Exception calling "CreateUpdateDownloader" with "0" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005
 (E_ACCESSDENIED))"
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ComMethodTargetInvocation

I've seen this mentioned on blogs as a bug, but with no backup to that claim. Two workarounds exist and both don't make me happy.

• Use psexec to run commands as the system user. PSExec is what I'm trying not to use as it has proven unreliable. I'd also like a pure powershell solution.
• Create a scheduled task and tell that to run your script as the system user. (via this post) This is not only messy but then I wont have the update results. I'll have to log to a file or update a database or something.

I'm open to other ways to run updates on a host remotely as this seems to be an issue a lot of people are hitting.

I found some docs that explains the message but not the reason or workaround.

Return Value Returns S_OK if successful. Otherwise, returns a COM or Windows error code.

This method can also return the following error codes.
Return code   Description
E_INVALIDARGA parameter value is invalid. 
E_ACCESSDENIED    This method cannot be called from a remote computer.

How does it know I'm on a remote computer?

In attempting to create a PowerShell script using remoting I ran into what I believe is the double-hop problem. In that article, Perriman gives a succinct description of the problem as well as the specific steps to resolve the issue (almost trivial if you know the commands, but for someone less familiar like myself, that information was invaluable!).

I ran Enable-WSManCredSSP Server on my Win7 server without incident, but attempting to run Enable-WSManCredSSP Client –DelegateComputer <FQDN of the server> on my Win7 client generated this error:

Enable-WSManCredSSP : The client cannot connect to the destination specified
in the request. Verify that the service on the destination is running and
is accepting requests.
Consult the logs and documentation for the WS-Management service running
on the destination, most commonly IIS or WinRM. If the destination
is the WinRM service, run the following com mand on the destination
to analyze and configure the WinRM service: "winrm quickconfig".

Running winrm quickconfig confirmed my server was running WinRM:

WinRM already is set up to receive requests on this machine.
WinRM already is set up for remote management on this machine.

And Get-WSManCredSSP confirmed my server was ready to accept credentials from a client:

The machine is not configured to allow delegating fresh credentials.
This computer is configured to receive credentials from a remote client computer.

I also found Boessen's article on WinRM wherein he describes general WinRM setup and found one tidbit to get a useful data point in diagnosis; this command run on the client uses the winrs tool to remotely access the server:

winrs -r:http://<FQDN of my server>:5985 -u:<myDomain>\msorens "dir c:\"

That command returned the expected result, the contents of the root directory on the server, without incident, confirming that my FQDN is correct and that WinRM is enabled.

Boessen indicates port 5985 is the default for Win7; this command run on the server confirms a value of 5985:

get-item wsman:\localhost\listener\listener*\port

The question: Why am I unable to execute the Enable-WSManCredSSP command on the client side?

2011.06.07 Update

I found a solution to the above question: invoking Enable-PSRemoting, advertised to configure a computer to receive remote commands, allowed the Enable-WSManCredSSP on the client to work successfully! Curious, but its man page indicates it does a number of different actions, so I assume one of those inadvertantly did what I needed.

But then I reached another roadblock when I attempted to use CredSSP authentication. Here is the command:

Invoke-Command { Write-Host "hello, world" } -computername $serverName `
-credential $testCred  -Authentication Credssp

And here is the response:

Connecting to remote server failed with the following error message:
The WinRM client cannot process the request. A computer policy does not allow
the delegation of the user credentials to the target computer. Use gpedit.msc
and look at the following policy: Computer Configuration
-> Administrative Templates -> System -> Credentials Delegation
-> Allow Delegating Fresh Credentials.  Verify that it is enabled and
configured with an SPN appropriate for the target computer. For example,
for a target computer name "myserver.domain.com", the SPN can be one of
the following: WSMAN /myserver.domain.com or WSMAN/*.domain.com.
For more information, see the about_Remote_Troubleshooting Help topic.

I verified the settings just as this remarkably helpful error message suggested, and it looks to me like it is configured properly.

The new question: What does this remote connection attempt with CredSSP fail?

In answering please keep the following in mind: Let me dispell in advance any notion that I know what I am doing here, any appearance to the contrary notwithstanding.:-) Windows admin is not my area of expertise!

Is it possible to recycle an IIS7 app pool from the command line, on a different machine?

I've found APPCMD (appcmd recycle apppool my-app-pool), but it only operates on the host it's run on, AFAICT.

I heard a rumor there might be a way to do it with Powershell, but I know nothing about that, and I'm apparently not very good at googling for it.

I'm using Vista / Server 2008, if that matters.

EDIT: I found something called WinRM that somebody claims is able to run APPCMD itself, but I'm not sure exactly how, yet.