mr-burnse
commented
7 years ago Error 1 - can you please check the windows event viewer and look for any events related to ASP.NET as the source? Paste the error here so we can get some more info on what's causing the 500 error.
Error 2 - Try running the following command on the target host (i.e. the one you are connecting to with orchestrator). In a production environment you should use the explicit IP of the Orchestrator server instead of the * wildcard.
winrm set winrm/config/client @{TrustedHosts="*"}
nhasanit
I am having issues using only the File Extraction forensic tool. If I try to extract a file from a remote host using the hostname I get:
•Exception calling "UploadFile" with "2" argument(s): "The remote server returned an error: (500) Internal Server Error."
If I try to extract using the IP address as the computer, i get:
•Connecting to remote server 10.XX.XXX.XXX failed with the following error message : The WinRM client cannot process the request. Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
I have tried accessing the console via the IP address and via the hostname. I have tried accessing the portal remotely as well as on the server that it sits on. All other forensics tools work so I dont believe this is firewall related.