New-PSSession in an Azure-runbook (ARM)

2
votes

For an Azure VM in the classic portal (ASM) I was able to obtain

  1. the required credentials with Get-AutomationPSCredential and
  2. the -ConnectionURI with Connect-AzureVM.ps1.

With these two parameters I was able to successfully execute a New-PSSession in an Azure-runbook.

Q What am I supposed to do to open a PS-Session in an Azure-runbook to an Azure-VM (ARM)?

Update

command in runbook (ARM)

$vmSession = New-PSSession -ConnectionUri 'https://xxx.yyy.cloudapp.azure.com:5985' -Credential $creds -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck)

error-message

New-PSSession : [xxx.yyy.cloudapp.azure.com] Connecting to remote server xxx.yyy.cloudapp.azure.com failed with the following error message : WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet. For more information, see the about_Remote_Troubleshooting Help topic.

1
powershellazureazure-powershellazure-automation
you've already asked a question about it, why do you ask again? – 4c74356b41
@4c74356b41 Even if I do have the -ConnectionURI which I've asked for, I'm not able to execute New-PSSession because of tons of errors :( – participant
well, post the errors at least?? post your code – 4c74356b41
@4c74356b41 ok, I've added an update. – participant
did you open the port on the NSG? can you manually connect? not from a runbook? – 4c74356b41

1 Answers

2
votes

According to your error, it seems that the port 5985 is blocked by some firewalls. You could use telnet to test connectivity.

telnet xxx.yyy.cloudapp.azure.com 5985

If it fails, you should check additionally:

  1. Open port 5985 on Windows Firewall(Inbound rules).

  2. Open port 5985 on Azure NSG(Inbound rules). Pay attention to NSG could be associated to NIC or subnet, you had better check them all.

enter image description here

  1. On your server VM, execute cmdlet.

    winrm quickconfig

Ensure you can access port 5985, then test on your local PC, and then test on an Azure Runbook.

I use the following cmdlets, it works for me.

New-PSSession -ConnectionUri 'http://IP:5985' -Credential $creds -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck)

Notes: If you don't configure a certificate on your server, you can not use https and you should use http instead.

PS C:\Users\v-shshui> New-PSSession -ConnectionUri 'http://*.*.*.*:5985' -Credential $creds -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck)

 Id Name            ComputerName    ComputerType    State         ConfigurationName     Availability
 -- ----            ------------    ------------    -----         -----------------     ------------
  7 Session7        *.*.*.*         RemoteMachine   Opened        Microsoft.PowerShell     Available

Also, if you want to use https, you need to configure a certificate as in shown in this link.

Update

If you want to winrm to your VM in an Azure Runbook, you should use https. It means that you should open port 5986 (by default) on Azure NSG and Windows Firewall. Also, you need add a new certificate on the Azure VM.