Powershell Remoting: Enable-WSManCredSSP fails with : This command cannot be executed because the setting cannot be enabled

1
votes

I tried the following command to enable CredSSP: 

Enable-WSManCredSSP -Role Client -DelegateComputer *.domain.local -Force

Enable-WSManCredSSP : This command cannot be executed because the setting cannot be enabled.

How do I overcome this error? What am I doing wrong? What is the reason for this error?

Get-WSManCredSSP

The machine is not configured to allow delegating fresh credentials. This computer is configured to receive credentials from a remote client computer.

winrm get winrm/config

Config
    MaxEnvelopeSizekb = 500
    MaxTimeoutms = 60000
    MaxBatchItems = 32000
    MaxProviderRequests = 4294967295
    Client
        NetworkDelayms = 5000
        URLPrefix = wsman
        AllowUnencrypted = false
        Auth
            Basic = true
            Digest = true
            Kerberos = true
            Negotiate = true
            Certificate = true
            CredSSP = true [Source="GPO"]
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        TrustedHosts = *.XXX.local [Source="GPO"]
    Service
        RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
        MaxConcurrentOperations = 4294967295
        MaxConcurrentOperationsPerUser = 1500
        EnumerationTimeoutms = 240000
        MaxConnections = 300
        MaxPacketRetrievalTimeSeconds = 120
        AllowUnencrypted = false
        Auth
            Basic = false
            Kerberos = true
            Negotiate = true
            Certificate = false
            CredSSP = true [Source="GPO"]
            CbtHardeningLevel = Relaxed
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        IPv4Filter = *
        IPv6Filter = *
        EnableCompatibilityHttpListener = false
        EnableCompatibilityHttpsListener = false
        CertificateThumbprint
        AllowRemoteAccess = true
    Winrs
        AllowRemoteShellAccess = true
        IdleTimeout = 7200000
        MaxConcurrentUsers = 10
        MaxShellRunTime = 2147483647
        MaxProcessesPerShell = 25
        MaxMemoryPerShellMB = 1024
        MaxShellsPerUser = 30
2
powershellwindows-server-2012powershell-remotingpowershell-4.0

2 Answers

0
votes

Are you using GPO to create WinRM listeners?

You need to enable Allow Delegating Fresh Credentials for the WinRM client policy and add the SPN with WSMAN prefix.

0
votes

There is also another way I was working on this problem almost two weeks and now I know that sometimes you can have problem with command Enable-WSManCredSSP -Role client -DelegateComputer "my host"

That is because command has no access for registry editing even when you are running PowerShell as administrator. I think it's Microsoft bug and I will create a ticket for MS Support

However there is workaround and you can do it by this script

https://github.com/bolvua/Enable-WSManCredSSP