PSSession using Invoke-Command return error during Test-Path check

2 down vote favorite
3
      

When executing an Invoke-Command on ServerA it starts executing on ServerB but the script halts on a Test-Path where is directory it is checking for exist on ServerB: I have tried passing my admin domain credential across but this has had no affect.



I have 2 Win 2008 R2 servers in the same domain. ServerA is the client executing remote powershell commands, serverB is the server being asked to execute a powershell script locally on it. I have also tried this in an Interactive PSSession with the same results.

    Both servers have enabled powershell remoting
    Both servers have configured winrm (winrm quickconfig)
    Both servers have TrustedHosts set to *
    Both servers have FireWall turned off
    Both servers have PowerShell 3.0


ServerA
========
$remote=New-PSSession -ComputerName $DeployHost -Credential $Cred
Invoke-Command -ComputerName $DeployHost -ScriptBlock $DeployCmdResources -ArgumentList $AppName, $CodeVersion


Error being sent back during the script execution on ServerB
============================================================
*** Beginning Installation ***
WebFilesType:  WebFilesLive
Exception trapped!
Test-Path : Access is denied
At F:\DeploymentScripts\deploy-SIDEA.ps1:367 char:8
+     if (!(Test-Path $passdir -pathType "Container"))
+           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Test-Path], UnauthorizedAccessException
sekoonAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

footechCommented:
Better check the permissions for the folder.  Even as admin it doesn't mean the account has permissions for everything.  That's what the error is indicating.
0
sekoonAuthor Commented:
Its not a permission error on teh folder as I can execute this script locally on server and it completes as expected. It just give the Test-Path access error when executing through either a local Enter-PSSesion or remote Invokde-Command.
0
footechCommented:
The path that you are checking is a local path on the machine you are remoting to, correct?  If not I would say the problem could be solved with CredSSP.
0
Newly released Acronis True Image 2019

In announcing the release of the 15th Anniversary Edition of Acronis True Image 2019, the company revealed that its artificial intelligence-based anti-ransomware technology – stopped more than 200,000 ransomware attacks on 150,000 customers last year.

QlemoBatchelor, Developer and EE Topic AdvisorCommented:
And you know for sure $passdir contains the proper, local path name? No UNC? And not an x86/x64 issue with virtual paths?
0
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
If I can't get what is happening with file operations, I use ProcMon from www.sysinternals.com, with an filter of e.g. "Path", "contains", and a part of the path name to check, and then repeat the file operation. You should then see what is tried and failing, and maybe even why.
0
sekoonAuthor Commented:
After going back and checking yes I see that the path being checked is a UNC not a local path.

\\netapp00\winopsdev\BuildRepository\stellar\credentials
0
sekoonAuthor Commented:
Executing the following locally from the server inside an elevated PS shell and taking the client out of the picture for the moment. I am logged onto the server with admin permissions and am still getting the access denied error.


Windows PowerShell
Copyright (C) 2012 Microsoft Corporation. All rights reserved.

PS C:\Users\laskoon.SCGGROUP> test-path \\netapp00\winopsdev\BuildRepository\stellar\credentials
True

PS C:\Users\laskoon.SCGGROUP> Enter-PSSession

cmdlet Enter-PSSession at command pipeline position 1
Supply values for the following parameters:
ComputerName: aspweb000
[aspweb000]: PS C:\Users\laskoon.SCGGROUP\Documents> test-path \\netapp09\winopsdev\BuildRepository\stellar\credentials
test-path : Access is denied
    + CategoryInfo          : PermissionDenied: (\\netapp00\wino...rbo\credentials:String) [Test-Path], UnauthorizedAccessException
    + FullyQualifiedErrorId : ItemExistsUnauthorizedAccessError,Microsoft.PowerShell.Commands.TestPathCommand

False

[aspweb000]: PS C:\Users\laskoon.SCGGROUP\Documents> test-path \\netapp09\winopsdev\BuildRepository\stellar\credentials -Credential SCGGROUP\laskoon
Cannot retrieve the dynamic parameters for the cmdlet. The FileSystem provider supports credentials only on the New-PSDrive cmdlet. Perform the operation again without
specifying credentials.
    + CategoryInfo          : InvalidArgument: (:) [Test-Path], ParameterBindingException
    + FullyQualifiedErrorId : GetDynamicParametersException,Microsoft.PowerShell.Commands.TestPathCommand

[aspweb000]: PS C:\Users\laskoon.SCGGROUP\Documents>
0
sekoonAuthor Commented:
Btw. also tried starting the PSSession with my credentials passed in and that did not change the results.

PS C:\Users\laskoon.SCGGROUP> Enter-PSSession -ComputerName aspweb000 -Credential laskoon
[aspweb000]: PS C:\Users\laskoon.SCGGROUP\Documents> test-path \\netapp00\winopsdev\BuildRepository\stellar\credentials
test-path : Access is denied
    + CategoryInfo          : PermissionDenied: (\\netapp00\wino...rbo\credentials:String) [Test-Path], UnauthorizedAccessException
    + FullyQualifiedErrorId : ItemExistsUnauthorizedAccessError,Microsoft.PowerShell.Commands.TestPathCommand

False
[aspweb000]: PS C:\Users\laskoon.SCGGROUP\Documents>
0
footechCommented:
Can you change to just using a local path with driver letter?
0
sekoonAuthor Commented:
Test-Path for UNS was giving me a headache so changes my process so that I drop whats in the folder to a local path. It appears even doing a Test-Path to a local directory I am getting access errors. When I do a Test-Path from the client to the server enter-pssession it returns TRUE as expect, just not when done via new-pssession.



Runtime Error
=============
*** Beginning Installation ***
WebFilesType:  WebFilesLive
Password File:  F:\Dropbox\STELLAR\credentials\prod F:\Dropbox\STELLAR\credentials\prod\stellarDeploy.json
Access to the path 'F:\Dropbox\STELLAR\credentials\prod' is denied.
    + CategoryInfo          : PermissionDenied: (F:\Dropbox\STELLAR\credentials\prod:String) [Get-Content], UnauthorizedAccessException
    + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand
    + PSComputerName        : aspweb000.stellar.live




Function
========

function GetPasswordFile([string]$dtype)
{

    $passdirtype = switch ($dtype)
    {
        "Prd" {"prod"}
        "Pbg" {"prod"}
        "Erf" {"prod"}
        "Ebg" {"prod"}
        "Stg" {"stage"}
        "Sbg" {"stage"}
        "Tst" {"test"}
        "Tbg" {"test"}
        "Dev" {"test"}
        "Dbg" {"test"}
        default {throw write-error "*** Error: Invalid deploy type. Must be one of: Prd, Pbg, Erf, Ebg, Stg, Sbg, Tst, Tbg, Dev, Dbg"}
    }

    $passdir = $BasePasswordDir + "\" + $passdirtype

      $passdir
      
      if (!(Test-Path $passdir -pathType "Container"))
      {
        $errMsg = "*** Error: Password File Directory: " + $passdir + " does not exist. "
            throw Write-Error $errMsg
      }

    $file_passwords = $passdir + "\" + $BasePasswordFile;

      if (!(Test-Path $file_passwords))
      {
        $errMsg = "*** Error: Password File: " + $file_passwords + " does not exist. "
            throw Write-Error $errMsg
      }

      return $file_passwords
}


#

$dtype ="Prd"
$BasePasswordDir = "F:\Dropbox\stellar\credentials"
$BasePasswordFile = "stellarDeploy.json"

GetPasswordFile
0
MazdajaiCommented:
Are you running new-pssession in an elevated prompt?
0
footechCommented:
I'm not clear on what you're describing for new-pssession and enter-pssession.
I've never encountered any problem with using Test-Path with a path local to where it is being run (whether run on the local machine or on a remote via Invoke-Command) unless the account doesn't have permissions.

If you would like to use UNC paths, then take a look at this link which describes the use of CredSSP.
http://blogs.technet.com/b/heyscriptingguy/archive/2012/11/14/enable-powershell-quot-second-hop-quot-functionality-with-credssp.aspx
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
sekoonAuthor Commented:
New-PSSession is being called from an elevated PS script yes.

I used Enter-PSSession to execute the Invoke-Command to try and see whats happening using an interactive session versus using New-PSSession and executing the Invoke-Command where I might only see some errors.


Yes I have setup CredSSP and have been using it in some of my testing to no help.
0
sekoonAuthor Commented:
At the moment I don't care whether I use a UNC or Local path but using either at  the moment the T est_path still fails

if (!(Test-Path $passdir -pathType "Container"))
0
footechCommented:
Try this command.  Substitute the remote computer name directly.
Invoke-Command -computername server1 -ScriptBlock {Test-Path c:\windows -PathType Container} 

Open in new window

Does it return "true"?
0
sekoonAuthor Commented:
Retrying WSManCredSSP from scratch again
0
sekoonAuthor Commented:
Making progress after re-doing the WSManCredSSP commands on client and hosts

PS C:\Users\laskoon.SCGGROUP> $credential = Get-Credential -Credential SCGGROUP\laskoon
PS C:\Users\laskoon.SCGGROUP> $remote=New-PSSession -ComputerName aspweb000.homeaway.live -Credential $credential -Authentication Credssp
PS C:\Users\laskoon.SCGGROUP> Invoke-Command -computername aspweb000.homeaway.live -ScriptBlock {Test-Path F:\Dropbox\STELLAR\credentials\prod -PathType Container}
True
PS C:\Users\laskoon.SCGGROUP> Invoke-Command -Session $remote -ScriptBlock {Test-Path \\netapp00\winopsdev\BuildRepository\stellar\credentials}
True
PS C:\Users\laskoon.SCGGROUP> Invoke-Command -Session $remote -ScriptBlock {Test-Path \\netapp00\winopsdev\BuildRepository\stellar\credentials -PathType Container}
True
PS C:\Users\laskoon.SCGGROUP>
0
sekoonAuthor Commented:
Troubleshooting the WSManCredSSP and getting the configuration correct solved the problem.

Thanks,
0
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
AFAIK CredSSP only comes into play if use a remote session to again remote, but using an UNC path in a remote session might qualify for that (as it needs to pass the credentials to the target device).

I recommend to post a comment about which steps you took to reset WSManCredSSP, accept that and http:#a39540022 as assisted (because of mentioning CredSSP).
0
sekoonAuthor Commented:
The host was remoting to a server which was reaching out to a netapp and until CredSSP was used the netapp was not honoring the request. I reappyed the WSManCredSSP on both the client and server as well as adding -authenicate CredSSP to the Invoke-Command

Invoke-Command -Session xxxxxxx Scriptblock{ccc.ps1}  -Credential $Cred -Authentication Credssp
0
sekoonAuthor Commented:
Given the direction to head I cleared all configuration on client and server to start with a clearer direction implementing CredSSP from the start and following as a guide re-configured both client and server. Then I added the -Cred and -Auth to the Invoke-Command and everything seem to be working as was originally expected.

http://dustinhatch.tumblr.com/post/24589312635/enable-powershell-remoting-with-credssp-using-group
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.