Script Fails When Provisioing SPAllInOne

[barry8schneider]

I am running on Windows 7 Home

Enabling CredSSP on SPAllInOne Enabling CredSSP Server... Auth Basic = false Kerberos = true Negotiate = true Certificate = false CredSSP = true CbtHardeningLevel = Relaxed

CredSSP Server is enabled. Pausing to Allow CredSSP to be enabled on SPAllInOne [sp-2kxoqt.cloudapp.net] Connecting to remote server sp-2kxoqt.cloudapp.net failed with the following error message : The WinRM client cannot process the request. A computer policy does not allow the delegation of the user credentials to the target computer. Use gpedit.msc and look at the following policy: Computer Configuration -> Administrative Templates -> System -> Credentials Delegation -> Allow Delegating Fresh Credentials. Verify that it is enabled and configured with an SPN appropriate for the target computer. For example, for a target computer name "myserver.domain.com", the SPN can be one of the following: WSMAN/myserver.domain.com or WSMAN/_.domain.com. For more information, see the about_Remote_Troubleshooting Help topic.

• CategoryInfo : OpenError: (sp-2kxoqt.cloudapp.net:String) [], PSRemotingTransportException
• FullyQualifiedErrorId : -2144108125,PSSessionStateBroken New-PSSession : [sp-2kxoqt.cloudapp.net] Connecting to remote server sp-2kxoqt.cloudapp.net failed with the following error message : The WinRM client cannot process the request. A computer policy does not allow the delegation of the user credentials to the target computer. Use gpedit.msc and look at the following policy: Computer Configuration -> Administrative Templates -> System -> Credentials Delegation -> Allow Delegating Fresh Credentials. Verify that it is enabled and configured with an SPN appropriate for the target computer. For example, for a target computer name "myserver.domain.com", the SPN can be one of the following: WSMAN/myserver.domain.com or WSMAN/_.domain.com. For more information, see the about_Remote_Troubleshooting Help topic. At C:\Users\MSIH\Google Drive\MSIH\SP2013\azure-sdk-tools-samples-master\azure-sdk-tools-samples-master\AutomatedDeployments\SharePoint\ProvisionSharePoint.ps1:126 char:13
  • $session = New-PSSession -ComputerName $spuris[0].DnsSafeHost -Credential $cred ...
  • CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTransportException
  • FullyQualifiedErrorId : -2144108125,PSSessionOpenFailed Invoke-Command : Cannot validate argument on parameter 'Session'. The argument is null or empty. Supply an argument that is not null or empty and then try the command again. At C:\Users\MSIH\Google Drive\MSIH\SP2013\azure-sdk-tools-samples-master\azure-sdk-tools-samples-master\AutomatedDeployments\SharePoint\ProvisionSharePoint.ps1:131 char:33
  • Invoke-Command -session $session -ArgumentList $webApp.Name, $config.Azu ...
  • CategoryInfo : InvalidData: (:) [Invoke-Command], ParameterBindingValidationException
  • FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.InvokeCommandCommand

Remove-PSSession : Cannot validate argument on parameter 'Id'. The argument is null. Supply a non-null argument and try the command again. At C:\Users\MSIH\Google Drive\MSIH\SP2013\azure-sdk-tools-samples-master\azure-sdk-tools-samples-master\AutomatedDeployments\SharePoint\ProvisionSharePoint.ps1:168 char:19

• Remove-PSSession $session

• 
  - CategoryInfo          : InvalidData: (:) [Remove-PSSession], ParameterBindingValidationException
  - FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.RemovePSSessionCommand

Script Execution Complete. Verify no errors during execution.

[prgit]

I'm getting the same error....

[prgit]

I thought Step 8, section a and B was an either/OR option.... so I hadnt completed what was in B.

After doing the following the error was fixed

B. Group Policy Editor Run GPEdit.msc You must also enable delegating of fresh credentials using group policy editor on your client machine. Computer Configuration -> Administrative Templates -> System -> Credentials Delegation and then change the state of "Allow Delegating Fresh Credentials with NTLM-only server authentication" to "Enabled." Its default state will say, "Not configured."

In the Add Servers sections add the following.

WSMAN/*.cloudapp.net

[bgfast]

Has anyone automated the edit of Group Policy Editor? This article looks like it has everything needed http://support.microsoft.com/kb/951608. I also saw the same error message. Turned out to be because of an extra character.

[barry8schneider]

This seems to work

$allowed = @('WSMAN/*.cloudapp.net')

$key = 'hklm:\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation' if (!(Test-Path $key)) { md $key } New-ItemProperty -Path $key -Name AllowFreshCredentials -Value 1 -PropertyType Dword -Force

$subKey = Join-Path $key 'AllowFreshCredentials' if (!(Test-Path $subKey)) { md $subKey } $i = 1 $allowed |% {

Script does not take into account existing entries in this key

New-ItemProperty -Path $subKey -Name $i -Value $_ -PropertyType String -Force
$i++

} New-ItemProperty -Path $key -Name AllowFreshCredentialsWhenNTLMOnly -Value 1 -PropertyType Dword -Force

$subKey = Join-Path $key 'AllowFreshCredentialsWhenNTLMOnly' if (!(Test-Path $subKey)) { md $subKey } $i = 1 $allowed |% {

Script does not take into account existing entries in this key

New-ItemProperty -Path $subKey -Name $i -Value $_ -PropertyType String -Force
$i++

}