Forum Discussion

Konstantinos N. Chionas's avatar
Konstantinos N. Chionas
Copper Contributor
Oct 15, 2018

Cluster Update asking to enable CredSSP

I installed Windows Admin Center, its great and working fine, but one of the things it advises me to do is to turn off CredSSP on servers, but when I use the Updates link on cluster page, it tells me...
JRoosen's avatar
JRoosen
Copper Contributor
Aug 06, 2019

Same issue here. It would be nice if there was an official guide to make this work. The way I am trying to set it up is have a centralized WAC VM running 2019 with the latest extension versions and we all connect to it from our respective Windows 10 clients. I am trying to use the Diagnostics module 1.1.10 the Hyper-Converged Cluster Manager to connect to an S2D 2019 cluster. While the module installs fine, the problem comes up in notifications of the following:

 

Error

Enable delegation


Source - Go to Diagnostics
Type

Error

Message

The workflow to enable CredSSP has been completed, but there was an error. Exception: This operation was blocked by role based access control settings"

 

The user I am trying to use is in the local "Windows Admin Center CredSSP Admins" group on the WAC and the enable-wsmancredssp -role client -delegatecomputer (nodes) has been completed successfully. I even added it to the SDDC instances and failover cluster instance FQDNs. Still does the same thing every time.

 

 

Haribo's avatar
Haribo
Copper Contributor
Aug 13, 2019

I'm having the same issue. It says access is blocked based on the RBAC settings, but the thing is; I don't even have RBAC enabled since this is a lab.

  • galenb's avatar
    galenb
    Copper Contributor
    Aug 16, 2019

    Haribo 

     

    I need more info about your gateway setup...

     

    Desktop or service mode?

     

    What is the execution policy of you gateway machine?  RemoteSigned. AllSigned, etc...

     

    Are your connections FQDN or IP addresses?

     

    TIA!

     

    Galen

    • Haribo's avatar
      Haribo
      Copper Contributor
      Aug 19, 2019

      galenb running in service mode on one of the cluster nodes. ExecutionPolicy was not changed from what it is by default. Connections were FQDN.

      • galenb's avatar
        galenb
        Copper Contributor
        Aug 22, 2019

        Haribo 

         

        Thanks for confirming service mode.  We are currently changing how the JEA endpoint that we use to configure CredSSP client on the gateway is configured to fix the issues reported.  One of the design goals was to not require that every user of the Windows Admin Center needed to be an administrator of the gateway host server to configure CredSSP.

         

        Is it possible to use desktop mode until the service mode fixes are available?  Desktop mode seems to be working more reliably...  If you try desktop mode and have problems please let me know.

Resources