Access Denied when using Power Shell Remoting with local account on Server Core 2019

2
votes

I want to remotely trigger some commands with power shell on a Windows Server Core 2019.

I am using the following to enter the remote Session:

$Username   = "x.x.x.x\Administrator"
$PasswordSS = ConvertTo-SecureString 'The-Password' -AsPlainText -Force
$Cred       = New-Object System.management.Automation.PSCredential $Username,$PasswordSS
Enter-PSSession -ComputerName 'x.x.x.x' -Credential $cred

The connection then fails with the following message:

Enter-PSSession : Connecting to remote server x.x.x.x failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic. At line:4 char:2 + Enter-PSSession -ComputerName 'x.x.x.x' -Credential $cred + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidArgument: (x.x.x.x:String) [Enter-PSSession], PSRemotingTransportException + FullyQualifiedErrorId : CreateRemoteRunspaceFailed

The remote computer is on the local network and I can ping it. The Administrator account is a local account on the remote computer. The remote ip is on the trusted host list on the client. PSRemoting was enabled on the remote computer.

What am I missing? Help would be appreciated.

2
windowspowershellservercoreremoting
Just for a test, open powershell as another user (with the one for which you created securedstring), and then try to perform Enter-PSSession If this works, you may have to look at your $cred again. – Mudit Bahedia
Hi, sry i cant follow you. What do you mean by with the "one for which you created securedstring"? – martinkk11
I mean open powershell with the same username ("x.x.x.x\Administrator") and password (The-Password) which you are using to create securestring. – Mudit Bahedia
That doesnt work. The remote account is only a local account and the remote pc is not in the same domain as the client. – martinkk11

2 Answers

1
votes

This ought to be in a comment. Not enough reps

a. Reset PSSession configurations: https://stackoverflow.com/a/22385798/10994804

b. Add -ComputerName 'x.x.x.x to trusted hosts.

Get-Item WSMan:\localhost\Client\TrustedHosts

Set-Item WSMan:\localhost\Client\TrustedHosts -Value x.x.x.x -Force
0
votes

CONTEXT ANALYSIS:

You chose another Input Language than the Time And Currency Format language during the installation. However, your choice is ignored for the Welcome Screen.

At the end of the installation, at the first boot, when you are asked to enter a password for the Administrator account, you type a password with the Time And Currency Format language but you are not aware of this.

At every login, you will use the Time And Currency Format language, until you change this behavior, but you are still not aware of it.

That's why you cannot:

  • PSRemote
  • RDP
  • change the local Administrator's password with ALT + CTRL + SUPPR

SOLUTION:

To be able to RDP or PSRemote, you must set the password again but with PowerShell

Set-LocalUser -Name Administrator -Password (Read-Host -AsSecureString)

However, now you won't be able to login with the console anymore. To fix this you must change the Welcome screen language.

Easy graphical solution for a few computers:

  1. In the command prompt type intl.cpl to open the Region control panel.
  2. Go to the Administrative tab.
  3. Click on the Copy settings button.
  4. Check the Welcome screen and system accounts check box.
  5. Click OK

PowerShell solution for many computers:

1.Check your current substitutes

Get-ItemProperty -Path 'HKCU:\Keyboard Laytout\Substitutes'

The complete list of Keyboard Identifiers can be found on Microsoft Docs:

Keyboard Identifiers and Input Method Editors for Windows

2.Check current substitutes of the Default user account

Get-ItemProperty -Path 'Registry::HKEY_USERS\.DEFAULT\Keyboard Layout\Substitutes'

3. Add one or all missing substitutes to the Default user account

New-ItemProperty -Path 'Registry::HKEY_USERS\.DEFAULT\Keyboard Layout\Substitutes' -Name '00000809' -Value '00000040c' -PropertyType 'String'

4. Just for information have a look at the current values of the Preload key of the Default user account

Get-ItemProperty -Path 'Registry::HKEY_USERS\.DEFAULT\Keyboard Layout\Preload'

5. Configure value 1 of the Preload key with the substitute name which will be used first on the Welcome screen. (If you want, you can also remove other values from the Preload key or even reorder them...)

Set-ItemProperty -Path 'Registry::HKEY_USERS\.DEFAULT\Keyboard Layout\Preload' -Name 1 -Value '00000809'