Solved

Exchange PowerShell remoting unable to reconnect in certain offices.

Posted on 2014-09-17
4
334 Views
Last Modified: 2014-09-18
So I am kind of at a loss on this one and thought I'd reach out.  I have a couple IT administrators in an international location who can't connect to Exchange to do remoting from their workstations, but they CAN from RDP sessions to machines that are in our headquarters.  When using the simplified below code to connect to Exchange:

$server = '<serverName>'
$s = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "http://$server/PowerShell/" -Authentication Kerberos
Import-PSSession $s

Open in new window


It connects fine and allows them to execute a few Exchange commands and then the PSSession breaks and when it goes to reconnect they get this error:

New-PSSession : [<serverName] Connecting to remote server <serverName> failed with the following error message : Access is denied.  For more information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:6
+ $s = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http:// ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo                  : OpenError: (System.Manageme....RemoteRunspace) [New-PSSession], PSRemotingTransportException
      + FullyQualifiedErrorId      : AccessDenied,PSSessionOpenFailed

What's interesting is that the initial session with the Exchange servers (version 2010 and 2013 report this..so PSv2 and v3) works just fine and it's only after the PSSession is broken is when this becomes an issue, so it's not a case where the user has rights.

The issues doesn't appear to be account specific since I can RDP into a computer in this office and experience the same problem even though from my normal workstation either across a VPN or even through a server in the central office it works just fine.

So I'm stuck on this one.  This issue is effecting all of the IT folks in this international office who need to run Exchange cmdlets via remoting so it seems to be tied to the office (which makes me think it's a networking thing, but it only happens with Exchange remoting and only when the session is broken and the re-connection code is called).

Any ideas?
0
Comment
Question by:evetsleep
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 37

Accepted Solution

by:
Jamie McKillop earned 500 total points
ID: 40330081
Hello,

Do you have any WAN optimizers in place? I've seen a similar issue where a WAN optimizer was the cause. It was related to Kerberos authentication. My network guys had to make some exclusions on the optimizers.

-JJ
0
 
LVL 1

Author Comment

by:evetsleep
ID: 40330777
Yeah...I'm looking into that.  I fired up some network monitors on the client and the server and I see the client sending an HTTP POST containing the Kerberos data and the server responds with a 200 OK and then the client sends a follow up POST that is a Kerberos encrypted session that never makes it to the server, but the funny thing is the client gets a 401 response from the server (which I never see on the server side network monitor).
0
 
LVL 37

Expert Comment

by:Jamie McKillop
ID: 40330785
The 401 is probably coming from the optimizer.

-JJ
0
 
LVL 1

Author Closing Comment

by:evetsleep
ID: 40331354
Jamie you were right.  I had the network folks put in an exclusion for the test host I was using where I could reproduce this 100% of the time after they told me there was a WAN optimizer in place.  After they did that the problem went away.  Now I just need to work with them to find out what kind of large scale solution we can put into place so that Kerberos authorization can work over HTTP with PowerShell.  Thanks!
0

Featured Post

Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
In previous parts of this Nano Server deployment series, we learned how to create, deploy and configure Nano Server as a Hyper-V host. In this part, we will look for a clustering option. We will create a Hyper-V cluster of 3 Nano Server host nodes w…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question