Now this error that's caused by the remote machine
executing it is to do with credentials.
So if we look back at our command,
so let me just clear this for a second, and we'll just enter the
command here, you can see that we're invoking this command on the
list of computers, and we're telling it to use credentials that I
created on this machine.
Now the problem is that when it gets from here to the other machines,
so i.e., the servers, apart from Active Directory,
it can't delegate the credentials that's been set up here on
that machine, so we then get an access denied.
So this is where we're able to do some simple configuration to get around this.
So I'm going to just come off this line here, and this is done by
using a new PowerShell cmdlet called WSManCredSSP.
So what this does is allows me to say I want this machine that
I'm working on to function as a client machine.
And then the servers that I wish to execute against,
I need them to work as a server.
Now what this does when we actually do this is we're going to specify the role,
and in this instance, I'm going to say this is the client.
Once I've specified this is the client,
I then need to say what the delegated computer would be.
Now if this is a single one‑time instance,
then I can go in and say this IP address or this fully‑qualified
domain name, so this would be server1.domain.com.
But what I can also do is actually just do a star here.
So I'm going to say Enter and just say Yes, and this will go ahead and say
I'm going to allow you, client machine, to take these credentials and post
them all the way over to that other machine.
Now, on the other machine,
which is the servers, we need to run a similar command.
Now I've already previously ran this,
so I'm going to show you the command here. And what this will do is we say
‑Role, and then we set to Server, and we execute this command on each of the
servers that we wish to be able to enable. As part of that remote PowerShell
configuration that we already did previously, this will allow us to send those
credentials from one to another.
So I'm going to just clear the screen. and what we'll do
is just loop back through my commands.
Now there is another thing we have to do,
but before we do that, let's see if this works.
So I'm going to press Enter.
It's going to go ahead, and you'll see it's still giving me the same error.
And that's because we need to tell the authentication
process to work a little bit differently.
So let's go back to my command.
We're going to leave our computers in there. We're going
to leave our credentials in there.
But what we're going to do is actually add an authentication
property, and then one of the options is Credssp.
Now what this will do is say go ahead and use the credentials,
connect to the remote machine, and use those credentials.
But if you have a problem, which is going to be an
access denied or unauthorized,
then I want you to delegate those credentials to the
other machine and allow it to execute.
Now, of course, before we do that because I've just run this, I need to
remove my TRAININGADVM one, so just delete that. We don't need that, and
minimize, and then I'm going to execute this command. So this is going to
go ahead to each of the machines,
pass the credentials across, and then execute that PowerShell script,
and now you'll notice it says that we have four files.
So let's go back to the file structure, and sure enough, I have four reports.
If I double‑click one of them here, you can see it gives me details.
There's my TRAININGSRV01.
If I click on TRAININGSRV03, TRAININGSRV03, TRAININGSRV02,
and then my Active Directory server.
So, a simple change will allow us to pass credentials from one location to
another location to allow things to execute correctly.
As you can see from running this one, it works really well.
Now, of course, what I did here was I used a local file path
for execution of that PowerShell script.
Now what about if I wanted to store that PowerShell script somewhere
else? So let's go back to my folder structure here.
I'm going to delete my Report files from my devices.
We'll just do this.
I'm going to click into the share a little bit more, and you
can see I've got the Scripts folder. And sure enough, I've got
that Report file that's there.
So what I'm going to do is get a copy of that UNC path. And what we'll
do is clear the screen a little bit here, and we'll reissue that same
command, but I'm actually going to use a UNC path for that PowerShell
script instead of running it locally.
So I think what happened the first time, I ran the command, and
I'd copied the Report.ps1 file to my machine, so
C:\Code\Report.ps1, and then I was basically rendering it in the
client here and then pushing it out.
What I want to do now is just say my report script is on a network
share, so think of the logic. You want to run a script against
multiple machines, but you don't want to copy it to the machines
or have it on one machine.
You want to just store it centrally and then execute.
So I'm going to use the same process again. I'm using my Credssp,
and I'm using the credentials, and I'm using my list of
computers, so I'm going to press Enter. This is now going to call
across to that network share, load that PS1 file remotely, and then execute.
And sure enough, it says it's created my files, so
let's go back to my file share again, go back to my Devices.
And sure enough, my files are here.
If I open up VM1, you'll see my same details.
So a couple of different ways of being able to execute either
sessions against single or multiple machines,
either running static commands or even just running
PowerShell scripts themselves against the machine.
Obviously, PowerShell scripts remotely that are stored either
locally or on a UNC path such as a file share.
So a simple process. The key is obviously to make sure that we have the delegation of credentials in order for that to work.