[QUESTION] How to Run PowerShell Scripts from WAC connection to Server?

%3CLINGO-SUB%20id%3D%22lingo-sub-461301%22%20slang%3D%22en-US%22%3E%5BQUESTION%5D%20How%20to%20Run%20PowerShell%20Scripts%20from%20WAC%20connection%20to%20Server%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-461301%22%20slang%3D%22en-US%22%3E%3CP%3EOK%2C%20this%20one%20I'm%20not%20filing%20as%20a%20bug%2C%20because%20I%20know%20it's%20just%20my%20own%20unfamiliarity%20with%20PowerShell%20through%20remote%20sessions%2C%20but%20maybe%20someone%20can%20point%20me%20in%20the%20right%20direction...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20server%20in%20my%20environment%20that%20is%20not%20a%20DC%20but%20has%20all%20the%20AD%20tools%20installed%20in%20order%20to%20remotely%20manage%20AD.%20Let's%20call%20it%20ADUTIL.%20On%20ADUTIL%2C%20I%20have%20a%20PowerShell%20script%20that%20I%20use%20for%20provisioning%20new%20OU%20and%20user%20structure%20for%20new%20clients...%20Prompts%20for%20a%20few%20variables%2C%20and%20then%20runs%20based%20on%20the%20results%20by%20creating%20an%20appropriate%20OU%20structure%2C%20groups%2C%20users%2C%20and%20group%20memberships%2C%20etc.%20This%20script%20runs%20flawlessly%20from%20a%20PowerShell%20session%20directly%20on%20ADUTIL%20server%20and%20runs%20its%20commands%20against%20server%20ADDC.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%2C%20I%20have%20a%20WAC%20server...%20let's%20call%20it%20WACUTIL.%20Using%20WACUTIL%2C%20I%20connect%20to%20ADUTIL%20and%20click%20on%20PowerShell%20extension.%20I%20login%2C%20I%20switch%20to%20my%20Scripts%20directory%2C%20run%20my%20script%2C%20but%20instead%20of%20working%2C%20the%20script%20generates%20errors%20like%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENew-ADOrganizationalUnit%20%3A%20Unable%20to%20contact%20the%20server.%20This%20may%20be%20because%20this%20server%20does%20not%20exist%2C%20it%20is%20currently%20down%2C%20or%20it%20does%20not%20have%20the%20Active%20Directory%20Web%20Services%20running.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELike%20I%20said%2C%20I%20think%20this%20is%20probably%20just%20my%20lack%20of%20understanding%20here%2C%20so%20maybe%20just%20a%20quick%20link%20or%20guidance%20would%20be%20helpful.%20Anybody%20have%20any%20suggestions%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-463782%22%20slang%3D%22en-US%22%3ERe%3A%20%5BQUESTION%5D%20How%20to%20Run%20PowerShell%20Scripts%20from%20WAC%20connection%20to%20Server%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-463782%22%20slang%3D%22en-US%22%3E%3CP%3EUnfortunately%20the%20Active%20Directory%20cmdlets%20don%E2%80%99t%20work%20in%20a%20remote%20PowerShell%20session%2C%20which%20is%20what%20WAC%20uses%20for%20the%20console%20on%20the%20machine%20you%20are%20managing.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOutside%20of%20WAC%2C%20if%20you%20open%20your%20local%20PowerShell%20console%20to%20connect%20like%20this%3A%3C%2FP%3E%0A%3CPRE%3EEnter-PSSession%20ADUTIL%3C%2FPRE%3E%0A%3CP%3EThen%20try%20the%20same%20script%20you%20were%20using%20in%20WAC%2C%20you%20should%20see%20the%20same%20errors.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20root%20cause%20of%20the%20AD%20cmdlets%20throwing%20this%20error%20in%20a%20remote%20session%20is%20referred%20to%20as%20the%20%E2%80%9Cdouble-hop%E2%80%9D%20problem.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20are%20on%20LAPTOP%2C%20connected%20to%20ADUTL.%20When%20you%20run%20a%20AD%20cmdlet%2C%20that%20cmdlet%20is%20making%20a%20remote%20call%20to%20the%20DC%20(the%20second%20%E2%80%9Chop%E2%80%9D)%2C%20which%20requires%20authentication.%20In%20this%20example%2C%20in%20the%20default%20configuration%2C%20there%20is%20no%20way%20for%20your%20credentials%20to%20get%20from%20LAPTOP%20to%20DC.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-481928%22%20slang%3D%22en-US%22%3ERe%3A%20%5BQUESTION%5D%20How%20to%20Run%20PowerShell%20Scripts%20from%20WAC%20connection%20to%20Server%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-481928%22%20slang%3D%22en-US%22%3EUnderstood....%20so%20I%20need%20a%20means%20of%20gathering%20the%20credentials%20and%20passing%20them%20through%2C%20providing%20the%20commands%20I'm%20using%20can%20support%20this.%20I%20think%20I%20saw%20a%20few%20other%20forum%20posts%20elsewhere%20discussing%20this%2C%20so%20I'll%20see%20what%20I%20can%20find%20based%20on%20that.%20Thanks%20for%20the%20response!%3C%2FLINGO-BODY%3E
Highlighted
Contributor

OK, this one I'm not filing as a bug, because I know it's just my own unfamiliarity with PowerShell through remote sessions, but maybe someone can point me in the right direction...

 

I have a server in my environment that is not a DC but has all the AD tools installed in order to remotely manage AD. Let's call it ADUTIL. On ADUTIL, I have a PowerShell script that I use for provisioning new OU and user structure for new clients... Prompts for a few variables, and then runs based on the results by creating an appropriate OU structure, groups, users, and group memberships, etc. This script runs flawlessly from a PowerShell session directly on ADUTIL server and runs its commands against server ADDC.

 

Now, I have a WAC server... let's call it WACUTIL. Using WACUTIL, I connect to ADUTIL and click on PowerShell extension. I login, I switch to my Scripts directory, run my script, but instead of working, the script generates errors like:

 

New-ADOrganizationalUnit : Unable to contact the server. This may be because this server does not exist, it is currently down, or it does not have the Active Directory Web Services running.

 

Like I said, I think this is probably just my lack of understanding here, so maybe just a quick link or guidance would be helpful. Anybody have any suggestions?

 

Thanks!

2 Replies
Highlighted

Unfortunately the Active Directory cmdlets don’t work in a remote PowerShell session, which is what WAC uses for the console on the machine you are managing.

 

Outside of WAC, if you open your local PowerShell console to connect like this:

Enter-PSSession ADUTIL

Then try the same script you were using in WAC, you should see the same errors.

 

The root cause of the AD cmdlets throwing this error in a remote session is referred to as the “double-hop” problem.

 

You are on LAPTOP, connected to ADUTL. When you run a AD cmdlet, that cmdlet is making a remote call to the DC (the second “hop”), which requires authentication. In this example, in the default configuration, there is no way for your credentials to get from LAPTOP to DC.

 

 

Highlighted
Understood.... so I need a means of gathering the credentials and passing them through, providing the commands I'm using can support this. I think I saw a few other forum posts elsewhere discussing this, so I'll see what I can find based on that. Thanks for the response!