New-PsSession fails with local account

Question

I am RDP'd into a workgroup computer and am trying to establish a PowerShell remoting session to a remote server, on a domain.

When I try to connect to the remote server, using one of its local admin accounts, I get the following error:

new-pssession : [IP] Connecting to remote server IP failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.

When I run connect using a domain admin account, the connetion works fine.

$domainCred = Get-Credential
$localCred = Get-Credential

PS C:\Users\ss_synadmin> New-PSSession -ComputerName IP -Credential $localCred
New-PSSession : [IP] Connecting to remote server IP failed with the following error message :
Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ New-PSSession -ComputerName <IP> -Credential $localcred
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotin
   gTransportException
    + FullyQualifiedErrorId : AccessDenied,PSSessionOpenFailed
PS C:\Users\ss_synadmin> New-PSSession -ComputerName <IP> -Credential $domainCred

 Id Name            ComputerName    State         ConfigurationName     Availability
 -- ----            ------------    -----         -----------------     ------------
 16 Session16       IP    Opened        Microsoft.PowerShell     Available

Since both accounts are admins, what gives?

StackExchangeGuy StackExchangeGuy · Accepted Answer · 2021-03-29T21:17:00

Drat, it was the LocalAccountTokenFilterPolicy registry entry (https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/support/troubleshooting#using-windows-admin-center-in-a-workgroup). I had checked it on the workgroup server, not on the domain server.

New-PsSession fails with local account

1 Answers