Powershell 远程 PSSession 失败 - 域管理员帐户答案

【问题标题】：Powershell Remote PSSession Failing - Domain Administrator AccountPowershell 远程 PSSession 失败 - 域管理员帐户
【发布时间】：2021-09-09 16:54:48
【问题描述】：

我正在对 PRTG 传感器未从我们的一台服务器收集 Windows 更新信息的问题进行故障排除。它使用 WinRM 和远程 PowerShell 命令来执行此操作。

服务器 1 - 问题服务器

服务器 2 - 工作服务器

当我尝试使用 Enter-PSSession -ComputerName Server1 或 winrs -r:Server1 dir 测试连接时，我不断收到以下错误：

PS C:\WINDOWS\system32> winrs -r:Server1 dir


Winrs error:WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config.

PS C:\WINDOWS\system32> Enter-PSSession -ComputerName Server1
Enter-PSSession : Connecting to remote server Server1 failed with the following error message : WinRM cannot process the request. The
following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more information, see the
about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ Enter-PSSession -ComputerName Server1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (Server1:String) [Enter-PSSession], PSRemotingTransportException
    + FullyQualifiedErrorId : CreateRemoteRunspaceFailed

如果我在我们的任何其他服务器上运行该命令，则连接成功，这是唯一给我带来麻烦的地方。

如果我使用我的用户帐户使用-Credential 开关运行命令Enter-PSSession，我会收到相同的错误，但如果我运行命令并指定服务器的本地管理员帐户，它将连接。其他服务器工作正常。

PS C:\WINDOWS\system32> Enter-PSSession -ComputerName Server1 -Credential Server1\administrator
[Server1]: PS C:\Users\Administrator\Documents> exit

PS C:\WINDOWS\system32> Enter-PSSession -ComputerName Server1 -credential domain\myuser
Enter-PSSession : Connecting to remote server Server1 failed with the following error message : WinRM cannot process the request. The
following error with errorcode 0x80090322 occurred while using Negotiate authentication: An unknown security error occurred.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more information, see the
about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ Enter-PSSession -ComputerName Server1 -credential alpenaw2k.local\kemp ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (Server1:String) [Enter-PSSession], PSRemotingTransportException
    + FullyQualifiedErrorId : CreateRemoteRunspaceFailed

PS C:\WINDOWS\system32> Enter-PSSession -ComputerName Server2
[Server2]: PS C:\Users\user\Documents> exit
PS C:\WINDOWS\system32>

如果我从本地服务器运行New-PSSession，我会得到同样的错误，除非我指定-EnableNetworkAccess 开关然后它会连接。这让我很困惑。事件查看器为我提供与用户身份验证相关的事件 ID 161 和会话创建失败的错误 142。

如果我从本地服务器和远程主机运行Test-WSMan，它会显示它正在运行。

这是 WinRM 配置和侦听器配置：

PS C:\Windows\system32> winrm get winrm/config
Config
    MaxEnvelopeSizekb = 500
    MaxTimeoutms = 60000
    MaxBatchItems = 32000
    MaxProviderRequests = 4294967295
    Client
        NetworkDelayms = 5000
        URLPrefix = wsman
        AllowUnencrypted = false
        Auth
            Basic = true
            Digest = true
            Kerberos = true
            Negotiate = true
            Certificate = true
            CredSSP = false
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        TrustedHosts = 10.10.10.142
    Service
        RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
        MaxConcurrentOperations = 4294967295
        MaxConcurrentOperationsPerUser = 1500
        EnumerationTimeoutms = 240000
        MaxConnections = 300
        MaxPacketRetrievalTimeSeconds = 120
        AllowUnencrypted = false
        Auth
            Basic = false
            Kerberos = true
            Negotiate = true
            Certificate = false
            CredSSP = false
            CbtHardeningLevel = Relaxed
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        IPv4Filter = *
        IPv6Filter = *
        EnableCompatibilityHttpListener = false
        EnableCompatibilityHttpsListener = false
        CertificateThumbprint
        AllowRemoteAccess = true
    Winrs
        AllowRemoteShellAccess = true
        IdleTimeout = 7200000
        MaxConcurrentUsers = 2147483647
        MaxShellRunTime = 2147483647
        MaxProcessesPerShell = 2147483647
        MaxMemoryPerShellMB = 2147483647
        MaxShellsPerUser = 2147483647

PS C:\Windows\system32> winrm enumerate winrm/config/listener
Listener
    Address = *
    Transport = HTTP
    Port = 5985
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = 10.10.10.87, 127.0.0.1, ::1, fe80::4579:db85:c9cb:ead0%6

我尝试过的其他事情：

我没有为 WinRM 设置 GPO。
我已删除并重新创建了监听器。
我已经多次重置 WinRM 的配置。
Windows 高级防火墙已禁用公共、专用和域网络。
我已经检查了Set-PSSessionConfiguration -Name Microsoft.PowerShell -ShowSecurityDescriptorUI 权限和权限似乎还可以。
我使用了相同的 IP 地址而不是主机名结果。
我已将我的计算机添加到受信任的主机列表中，但它没有工作。这不应该是必要的，因为两台计算机位于同一个域中。
跑Enable-PSRemoting -Force（虽然这应该是不必要的因为 WinRM 默认为 Server 2012 及更高版本启用）。
我已将我的用户添加到本地管理员和远程服务器上的管理用户没有运气。
我已经调整了REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 的注册表，但这并没有工作，不管它的价值。
我已重新启动并运行 sfc /scannow 作为最后的努力。

服务器、工作站和我的用户的规格：

我的域帐户是域管理员。
服务器是 Windows Server 2019 Standard。
工作站是 Windows 10 专业版。
两者都使用 PowerShell 版本 5。
两台计算机在同一个域中。
两台计算机都是最新的。

我可以使用本地管理员帐户来轮询此信息并解决我令人生畏的问题，但这并不能解决根本问题。

编辑：

来自远程服务器的 Windows 远程管理日志中没有错误条目，但在我的计算机上我有这些：

错误事件 ID - 142

WSMan operation Enumeration failed, error code 2150858909

错误事件 ID - 49

The WinRM protocol operation failed due to the following error: WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.  
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config..

错误事件 ID - 161

WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.  
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config.

我可以 RDP 进入服务器就好了，这就是我一直在做一些本地测试的方式。

我测试了这两个命令：

gwmi win32_operatingsystem -ComputerName Server1 正常执行没有问题，即指定远程服务器和 RDPing 在本地运行。

Get-CimInstance win32_operatingsystem -ComputerName Server1我无法从我的工作站运行，但是如果我 RDP 进入服务器并运行它，它将正常执行。

【问题讨论】：

您能否在其他服务（如 rdp 或 wmi/rpc）上与同一用户进行身份验证？在不使用 -Credential 的情况下尝试 gwmi win32_operatingsystem -computername Server1 和 Get-CimInstance win32_operatingsystem -computername Server1。您可以尝试连接另一台客户端计算机吗？
您也可以添加事件日志详细信息吗？他们可以详细了解额外的奇怪问题，例如：serverfault.com/a/580412/411612
我可以 RDP 进入服务器就好了，这就是我一直在做一些本地测试的方式。我测试了列出的两个命令，对于 gwmi win32_operatingsystem -computername Server1 命令，它正常执行没有问题，即指定远程服务器和 RDPing 在本地运行。对于Get-CimInstance win32_operatingsystem -computername Server1，我无法从我的工作站运行它，但如果我 RDP 进入服务器并运行它，它将正常执行。
我已将事件添加到主要问题中
我觉得这篇文章真的需要去serverfault。开发人员常用的开发工具和程序在此处说到点，但这确实超出了编程问答网站可以合理提供的帮助。这里有大量可能出错的地方，而且 Kerberos 身份验证失败可能很难调试。

标签： windows powershell winrm

【解决方案1】：

我已经解决了。

这是一个 SPN 问题。 HTTP/Server1 和 HTTP/Server1.domain 正被以服务器命名的随机用户帐户使用。

在禁用帐户并将 SPN 移动到计算机对象后，WinRM 现在可以正常工作了。

This 帮助我找到了正确的方向。

【讨论】：