1

I have a need to execute a batch file on a remote machine, where the batch file being executed resides on a remote fileshare. I have been able to use CredSSP authentication in Powershell to do this assuming my ID is admin on the remote machine, but once I remove the admin access I get the following:

Access denied
+ CategoryInfo : InvalidOperation: (:) [Invoke-WmiMethod], ManagementException
+ FullyQualifiedErrorId : InvokeWMIManagementException,Microsoft.PowerShell.Commands.InvokeWmiMethod

I have tried enabling my ID to have full control to Microsoft.Powershell as recommended here but with no luck: http://blogs.msdn.com/b/powershell/archive/2009/11/23/you-don-t-have-to-be-an-administrator-to-run-remote-powershell-commands.aspx

The commands I am running:

$s = New-PSSession -computerName $remoteMachine -Credential $cred -Authentication CredSSP

Invoke-Command -Session $s -Scriptblock {param($remoteBatchFile) invoke-wmimethod -path win32_process -name create -argumentlist $remoteBatchFile} -ArgumentList $remoteBatchFile

Remove-PSSession $s

Any suggestions for how to resolve the security error? I do have requirements to run the batch file from the network location and for the ID to not be admin on either of the machines. Any suggestions would be appreciated, thanks!

1 Answer 1

0

You are facing the dreaded 2nd hop issue. In a PowerShell remoting session you can't hop or easily reference other network resources without re-authenticating. Using CredSSP is one way around this. Another way that I've used is in your remote session add a NET USE command to temporarily map a drive to the remote computer, specifying a username and password.

6
  • I've verified that I can retrieve the network resource on the remote machine while my ID is in the admin group, so I believe I've gotten past the 2nd hop issue. My hangup is with being able to do so without having my ID as an admin on the remote machine. It seems to me like the error has to do with the Invoke-WMIMethod and some sort of permission I would need to configure, but so far I haven't been able to figure out what exactly that may be.
    – Nick
    Apr 9, 2012 at 20:41
  • If you are just trying to launch the batch file on the remote computer, you don't need Invoke-WMIMethod. Just run the batch file in Invoke-Command. Apr 9, 2012 at 21:45
  • I've found that if I call it from an interactive session that approach works, however I'm looking to execute this as a batch script. For instance, this works: Invoke-Command -Session $s -Scriptblock {param($remoteBatchFile) start-process $remoteBatchFile} -ArgumentList $remoteBatchFile However once I issue the Remove-PSSession command the executables I have kicked off terminate. If they are invoked as WMIMethods they persist beyond the closure of the PSSession, which was my rationale in kicking it off that way.
    – Nick
    Apr 9, 2012 at 22:02
  • If you are using Invoke-WMIMethod, you don't really need to use Invoke-Command. That is just adding another layer of complexity. The method will execute ON the remote machine. Try Invoke-WMIMethod with -computername. Apr 10, 2012 at 0:07
  • I'm still unable to get the Invoke-WMIMethod to function without administrator access. Is there an easy way to monitor for the completion of the remotely executed process? I can probably rig it up to use some sort of filewatcher but I wonder if there is an easier way.
    – Nick
    Apr 10, 2012 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.