fellenberger
commented
8 years ago Would also like to note that I have successfully used the Windows native WinRM plugin to establish a remote powershell session with the very same non-admin account, so this looks to be isolated to how the Ruby WinRM plugin is attemtping to establish the WinRM session with the non-admin account.
https://technet.microsoft.com/en-us/library/hh847850.aspx
On server that you want to execute remote powershell commands on: Set-PSSessionConfiguration Microsoft.PowerShell -ShowSecurityDescriptorUI -- add user/group that you want to execute command as
From Remote Computer:
Invoke-Command -ComputerName server_name -ScriptBlock { dir } -credential MS
Enable-PSRemoting -Force
Test-WsMan server_name
spuder
vvchik
This is likely more of a Windows WMI question, but I'm hoping someone has some guidance here. I've successfully used the plugin against a remote Win2K12 R2 server using a Windows Domain user that is part of the Administrators group on that remote server. No problems, all is good.
However, my attempts to successfully execute a job that has a single WinRM command with the same user not being in the Administrators group have proved fruitless to date.
Based on scouring the net, I came across a handful of articles that attempt to spell out how to get this working, but I haven't had good luck yet.
To summarize my efforts: I removed the user from the Administrators group and added to the "WinRMRemoteWMIUsers__" as many articles have suggested.
I then went into "WMI Control" in Computer Management, and added the "WinRMRemoteWMIUsers__" group to Security -> "Root" with Execute Methods, Enable Account, andf Remote Enable privs enabled. Finally restarted the Windows Management Instrumentation service, and all supposedly should have worked. However it didn't.
Reference: https://social.technet.microsoft.com/Forums/exchange/en-US/b748d1bb-fa97-4c30-a626-145dfbc40873/service-acccount-permission-to-remote-powershell-to-dns-server-on-windows-server-2012?forum=winserverpowershell
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/60de5fcd-33e0-479b-9668-fcf683678a2f/winrm-for-nonadministrative-users?forum=ITCG
Gist of the error Rundeck is trapping is as follows:
/usr/local/share/gems/gems/winrm-1.6.1/lib/winrm/http/response_handler.rb:75:in `raise_if_wmi_error': [WMI ERROR CODE: 2150859012]:2/p:CIMStatusCode0/p:ErrorSourceFormat0/p:ErrorTypeThe WS-Management service cannot process the request. The WMI service returned an 'access denied' error. /p:MessageHRESULT 0x80338104/p:MessageID0/p:PerceivedSeverity0/p:ProbableCause18/p:error_Category2150859012/p:error_CodeHRESULT/p:error_TypeThe WS-Management service cannot process the request. The WMI service returned an 'access denied' error. /p:error_WindowsErrorMessage/p:MSFT_WmiError (WinRM::WinRMWMIError)
I also reviewed the Windows Event Viewer on the remote server, and see the following: Id = ; ClientMachine =; User = MS; ClientProcessId = 916; Component = WMIService; Operation = connect to namespace : root\cimv2; ResultCode = 0x80041003; PossibleCause = the user was not granted appropriate permission on the namespace.
Just doesn't make sense as I granted privs to "Root" and ensured that the privs applied to the Root namespace, and sunnamespaces...
Any ideas here? Won't be feasible to run remote commands as a user in the Administrators group!
Thanks!