2
votes

I'm trying to configure my LyncServer via a WcfService that itself does PowerShell remoting to run Cmdlets on the Lync machine. I successfully import the Lync module, but when i try to call and Lync cmdlet, e.g. Get-CsUser i receive a error in powershell.Streams.Error:

Active Directory error "-2147016672" occurred while searching for domain control lers in domain "my.test.domain": "An operations error occurred."

This is how i create my Runspace:

PSCredential psCred = new PSCredential(this.Credentials.Domain + "\\" + this.Credentials.UserName, this.Credentials.SecurePassword);
WSManConnectionInfo wsman = new WSManConnectionInfo(uri, c_powerShellShema, psCred);
wsman.AuthenticationMechanism = AuthenticationMechanism.Default;
//wsman.AuthenticationMechanism = AuthenticationMechanism.Kerberos;
//wsman.ProxyAuthentication = AuthenticationMechanism.Negotiate;      

Runspace retval = RunspaceFactory.CreateRunspace();//wsman);
retval.Open();

and my powershell calls

PowerShell powerShell = PowerShell.Create();
powerShell.Runspace = this.Runspace;
powerShell.AddScript("Import-Module Lync");
powerShell.Invoke();
powerShell.Streams.ClearStreams();
powerShell.AddScript("Get-CsUser);
powerShell.Commands.AddCommand("Out-String");

var retval = powerShell.Invoke();
foreach (var o in retval)
    Console.WriteLine(o.ToString());

foreach (var e in powerShell.Streams.Error)
    Console.WriteLine(e.ToString());

Any idea? the User that is used in the Runspace is the same user that i used to do all the lync configuration via the lync management console, so he has all access permissions he need.

3

3 Answers

1
votes

You are not working with ASP.NET but perhaps How to use the System.DirectoryServices namespace in ASP.NET can explain your problem.

You certainly know but when you've got an error like -2147016672, convert it in hexa (0x80072020) and google the Micosoft thechnologie name and the Hexa code "Active-Directory 0x 80072020" for online help on the problem.

1
votes

i finally found the answer here: Powershell v2 remoting and delegation. so i called Enable-PsRemoting on ther server and i works fine.

1
votes

You are using default authentication

wsman.AuthenticationMechanism = AuthenticationMechanism.Default;

While any lync/skype for business command such as Get-CsUser or Enable-CsUser or Disable-CsUser connects the domain controller from your server.

So while connecting to the DC the call doesn't specify which credentials to user because the ones you provided were for the target(Skype server) only not the DC.

Hence you will have to use CredSSP whenever there are multiple hops involved, because CredSSP tells to use the same credential while connecting to the next hop.

You can refer this article, it explains way better than how I might have.:p

https://sysnetdevops.com/2016/09/16/skype-for-business-server-and-powershell-remoting/