Error when to resolve Double Hop issue with powershell

Question

Today we need to resolve double hop issue with PowerShell.

But it is failed when we do following try:
Machines: client1, server1, networkpath

One client1 run following:

$session = New-PSSession -Computer server1 -Authentication Credssp  -Credential "username"

Following error thrown:

New-PSSession : [server1] Connecting to remote server server1 failed with the
following error message : The WinRM client cannot process the request. The
authentication mechanism requested by the client is not supported by the server
or unencrypted traffic is disabled in the service configuration. Verify the
unencrypted traffic setting in the service configuration or specify one of the
authentication mechanisms supported by the server.  To use Kerberos, specify the
computer name as the remote destination. Also verify that the client computer
and the destination computer are joined to a domain. To use Basic, specify
the computer name as the remote destination, specify Basic authentication and
provide user name and password. Possible authentication mechanisms reported by
server: Negotiate For more information, see the about_Remote_Troubleshooting
Help topic.
At line:1 char:12
+ $session = New-PSSession -Computer server1 -Authentication Credssp  -Creden ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotin    gTransportException
    + FullyQualifiedErrorId : AccessDenied,PSSessionOpenFailed

We have done following configuration:
Client1:

Enable-WSManCredSSP -Role Client -DelegateComputer Server1

Server1:

Enable-WSManCredSSP -Role Server

All servers are in workgroup.

Amitabha Amitabha · Accepted Answer · 2014-11-27T09:43:24

Following suggestions from Resolve Double-Hop Issue in PowerShell Remoting

following steps can fix the err

Run gpedit.msc on client.
Expand to Local Computer Policy -> Computer Configuration -> Administrative Templates -> System -> Credentials Delegation.
Double click Allow Delegating Fresh Credentials with NTLM-only Server Authentication.
Enable Allow Delegating Fresh Credentials.
Click Show... and add wsman/Server1.
Click several OK to close the popup dialogs.

Now we can run following script successful on client:

$session = New-PSSession -Computer server1 -Authentication Credssp  -Credential "username"
Enter-PSSession $session
Test-Path "NetWorkPath"

Error when to resolve Double Hop issue with powershell

2 Answers