title: Powershell Remote PSSession Failing - Domain Administrator Account
body: <p>I am troubleshooting an issue I have with a PRTG sensor not collecting Windows Update information from one of our servers. It is using WinRM and a remote PowerShell command to do that.</p>
  <p>Server 1 - Issue Server</p>
  <p>Server 2 - Working Server</p>
  <p>When I try to use <code>Enter-PSSession -ComputerName Server1</code> or <code>winrs -r:Server1 dir</code> to test the connection I keep getting the following errors:</p>
  <pre><code>PS C:\WINDOWS\system32&gt; winrs -r:Server1 dir
  
  
  Winrs error:WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.
   Possible causes are:
    -The user name or password specified are invalid.
    -Kerberos is used when no authentication method and no user name are specified.
    -Kerberos accepts domain user names, but not local user names.
    -The Service Principal Name (SPN) for the remote computer name and port does not exist.
    -The client and remote computers are in different domains and there is no trust between the two domains.
   After checking for the above issues, try the following:
    -Check the Event Viewer for events related to authentication.
    -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
   Note that computers in the TrustedHosts list might not be authenticated.
     -For more information about WinRM configuration, run the following command: winrm help config.
  
  PS C:\WINDOWS\system32&gt; Enter-PSSession -ComputerName Server1
  Enter-PSSession : Connecting to remote server Server1 failed with the following error message : WinRM cannot process the request. The
  following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.
   Possible causes are:
    -The user name or password specified are invalid.
    -Kerberos is used when no authentication method and no user name are specified.
    -Kerberos accepts domain user names, but not local user names.
    -The Service Principal Name (SPN) for the remote computer name and port does not exist.
    -The client and remote computers are in different domains and there is no trust between the two domains.
   After checking for the above issues, try the following:
    -Check the Event Viewer for events related to authentication.
    -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
   Note that computers in the TrustedHosts list might not be authenticated.
     -For more information about WinRM configuration, run the following command: winrm help config. For more information, see the
  about_Remote_Troubleshooting Help topic.
  At line:1 char:1
  + Enter-PSSession -ComputerName Server1
  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : InvalidArgument: (Server1:String) [Enter-PSSession], PSRemotingTransportException
      + FullyQualifiedErrorId : CreateRemoteRunspaceFailed
  </code></pre>
  <p>If I run the command on any of our other servers the connection is successful, this is the only one giving me trouble.</p>
  <p>If I run the command <code>Enter-PSSession</code> with the <code>-Credential</code> switch with my user account I get the same error, but if I run the command and specify the local administrator account of the server it will connect. Other servers work fine.</p>
  <pre><code>PS C:\WINDOWS\system32&gt; Enter-PSSession -ComputerName Server1 -Credential Server1\administrator
  [Server1]: PS C:\Users\Administrator\Documents&gt; exit
  
  PS C:\WINDOWS\system32&gt; Enter-PSSession -ComputerName Server1 -credential domain\myuser
  Enter-PSSession : Connecting to remote server Server1 failed with the following error message : WinRM cannot process the request. The
  following error with errorcode 0x80090322 occurred while using Negotiate authentication: An unknown security error occurred.
   Possible causes are:
    -The user name or password specified are invalid.
    -Kerberos is used when no authentication method and no user name are specified.
    -Kerberos accepts domain user names, but not local user names.
    -The Service Principal Name (SPN) for the remote computer name and port does not exist.
    -The client and remote computers are in different domains and there is no trust between the two domains.
   After checking for the above issues, try the following:
    -Check the Event Viewer for events related to authentication.
    -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
   Note that computers in the TrustedHosts list might not be authenticated.
     -For more information about WinRM configuration, run the following command: winrm help config. For more information, see the
  about_Remote_Troubleshooting Help topic.
  At line:1 char:1
  + Enter-PSSession -ComputerName Server1 -credential alpenaw2k.local\kemp ...
  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : InvalidArgument: (Server1:String) [Enter-PSSession], PSRemotingTransportException
      + FullyQualifiedErrorId : CreateRemoteRunspaceFailed
  
  PS C:\WINDOWS\system32&gt; Enter-PSSession -ComputerName Server2
  [Server2]: PS C:\Users\user\Documents&gt; exit
  PS C:\WINDOWS\system32&gt;
  </code></pre>
  <p>If I run <code>New-PSSession</code> from the local server I will get the same error, unless I specify the <code>-EnableNetworkAccess</code> switch and then it will connect. This confuses me. Event viewer gives me Event ID 161 related to user authentication and error 142 for the session failing to create.</p>
  <p>If I run <code>Test-WSMan</code> from the local server and a remote host it shows it running.</p>
  <p>Here is the WinRM config and the listener config:</p>
  <pre><code>PS C:\Windows\system32&gt; winrm get winrm/config
  Config
      MaxEnvelopeSizekb = 500
      MaxTimeoutms = 60000
      MaxBatchItems = 32000
      MaxProviderRequests = 4294967295
      Client
          NetworkDelayms = 5000
          URLPrefix = wsman
          AllowUnencrypted = false
          Auth
              Basic = true
              Digest = true
              Kerberos = true
              Negotiate = true
              Certificate = true
              CredSSP = false
          DefaultPorts
              HTTP = 5985
              HTTPS = 5986
          TrustedHosts = 10.10.10.142
      Service
          RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
          MaxConcurrentOperations = 4294967295
          MaxConcurrentOperationsPerUser = 1500
          EnumerationTimeoutms = 240000
          MaxConnections = 300
          MaxPacketRetrievalTimeSeconds = 120
          AllowUnencrypted = false
          Auth
              Basic = false
              Kerberos = true
              Negotiate = true
              Certificate = false
              CredSSP = false
              CbtHardeningLevel = Relaxed
          DefaultPorts
              HTTP = 5985
              HTTPS = 5986
          IPv4Filter = *
          IPv6Filter = *
          EnableCompatibilityHttpListener = false
          EnableCompatibilityHttpsListener = false
          CertificateThumbprint
          AllowRemoteAccess = true
      Winrs
          AllowRemoteShellAccess = true
          IdleTimeout = 7200000
          MaxConcurrentUsers = 2147483647
          MaxShellRunTime = 2147483647
          MaxProcessesPerShell = 2147483647
          MaxMemoryPerShellMB = 2147483647
          MaxShellsPerUser = 2147483647
  
  PS C:\Windows\system32&gt; winrm enumerate winrm/config/listener
  Listener
      Address = *
      Transport = HTTP
      Port = 5985
      Hostname
      Enabled = true
      URLPrefix = wsman
      CertificateThumbprint
      ListeningOn = 10.10.10.87, 127.0.0.1, ::1, fe80::4579:db85:c9cb:ead0%6
  </code></pre>
  <p>Other things I have tried:</p>
  <ul>
  <li>I have no GPO settings in place for WinRM.</li>
  <li>I have deleted and recreated the listener.</li>
  <li>I have reset the config of WinRM several times.</li>
  <li>Windows Advanced Firewall is disabled for Public, Private, and Domain
  networks.</li>
  <li>I have checked the <code>Set-PSSessionConfiguration -Name Microsoft.PowerShell -ShowSecurityDescriptorUI</code> permissions and the
  privileges seem okay.</li>
  <li>I have used IP addresses instead of hostnames with the same
  results.</li>
  <li>I have added my computer to the trusted host list and it does not
  work. This shouldn't be necessary though as the both the computers
  are on the same domain.</li>
  <li>Ran <code>Enable-PSRemoting -Force</code> (Although this should be unnecessary
  as WinRM is enabled by default for Server 2012 and forward).</li>
  <li>I have added my user to the Local Administrators and Remote
  Management Users on the server with no luck.</li>
  <li>I have adjusted the registry of <code>REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1</code> and this does not
  work regardless of its value.</li>
  <li>I have rebooted and ran an <code>sfc /scannow</code> as a last ditch effort.</li>
  </ul>
  <p>Specs of the server, workstation, and my user:</p>
  <ul>
  <li>My domain account is a Domain Administrator.</li>
  <li>Server is Windows Server 2019 Standard.</li>
  <li>Workstation is Windows 10 Pro.</li>
  <li>PowerShell Version 5 for both.</li>
  <li>Both computers are on the same domain.</li>
  <li>Both computers are up to date.</li>
  </ul>
  <p>I could use the local administrator account to poll this information and fix my intimidate problem, but that doesn't fix the underlying issue.</p>
  <p>EDIT:</p>
  <p>From the remote server there are no error entries in the Windows Remote Management Log, but on my computer I have these:</p>
  <p>Error Event ID - 142</p>
  <pre><code>WSMan operation Enumeration failed, error code 2150858909
  </code></pre>
  <p>Error Event ID - 49</p>
  <pre><code>The WinRM protocol operation failed due to the following error: WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.  
   Possible causes are:
    -The user name or password specified are invalid.
    -Kerberos is used when no authentication method and no user name are specified.
    -Kerberos accepts domain user names, but not local user names.
    -The Service Principal Name (SPN) for the remote computer name and port does not exist.
    -The client and remote computers are in different domains and there is no trust between the two domains.
   After checking for the above issues, try the following:
    -Check the Event Viewer for events related to authentication.
    -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
   Note that computers in the TrustedHosts list might not be authenticated.
     -For more information about WinRM configuration, run the following command: winrm help config..
  </code></pre>
  <p>Error Event ID - 161</p>
  <pre><code>WinRM cannot process the request. The following error with errorcode 0x80090322 occurred while using Kerberos authentication: An unknown security error occurred.  
   Possible causes are:
    -The user name or password specified are invalid.
    -Kerberos is used when no authentication method and no user name are specified.
    -Kerberos accepts domain user names, but not local user names.
    -The Service Principal Name (SPN) for the remote computer name and port does not exist.
    -The client and remote computers are in different domains and there is no trust between the two domains.
   After checking for the above issues, try the following:
    -Check the Event Viewer for events related to authentication.
    -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
   Note that computers in the TrustedHosts list might not be authenticated.
     -For more information about WinRM configuration, run the following command: winrm help config.
  </code></pre>
  <p>I can RDP into the server just fine, that's how I have been doing some of the local tests.</p>
  <p>I tested these two commands:</p>
  <p><code>gwmi win32_operatingsystem -ComputerName Server1</code> executes normally with no issue, that's specifying the remote server and RDPing to running locally.</p>
  <p><code>Get-CimInstance win32_operatingsystem -ComputerName Server1</code> I cannot run from my workstation, but If I RDP into the sever and run it, it will execute normally.</p>