question

BenjaminPeikes-7466 avatar image
0 Votes"
BenjaminPeikes-7466 asked BenjaminPeikes-7466 edited

Using Invoke-Command using Credentials to run Get-RDRemoteApp fails

I have a script which I can run locally on our ConnectionBroker, though the session has to be elevated, which manages our RDRemoteApp collections. We're trying to automate processes and remote the requirement of having someone actually log onto the ConnectionBroker to run scripts manually. To do so, we are trying to use Invoke-Command to run the script remotely.
Even though we pass credentials for a user that is in domain administrator group, the following script gives us an error when run remotely:

$server = "ConnectionBrokerName"
$collectionName ="OurCollection"

$password = ConvertTo-SecureString "password" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential ("DOMAIN\domain_admin", $password)

$sb =
{
Import-Module RemoteDesktop
Import-Module RemoteDesktopServices
Get-RDRemoteApp -CollectionName $Using:$collectionName
}

Invoke-Command -Credential $cred -ComputerName $server -ScriptBlock $sb

This will return an error like:
A Remote Desktop Services deployment does not exist on ConnectionBrokerName.DOMAIN.COM. This operation can be performed after creating a deployment. For information about creating a
deployment, run "Get-Help New-RDVirtualDesktopDeployment" or "Get-Help New-RDSessionDeployment".
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get-RDRemoteApp
+ PSComputerName : ConnectionBrokerName




windows-server-powershellremote-desktop-services
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

RichMatheisen-8856 avatar image
0 Votes"
RichMatheisen-8856 answered BenjaminPeikes-7466 commented

The value of $collectionName needs to be passed as a parameter to the script block.

Try using (no pun intended) something like this:

 $sb =
 {
     Import-Module RemoteDesktop
     Import-Module RemoteDesktopServices
     Get-RDRemoteApp -CollectionName $USING:collectionName
 }
· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks for pointing that out, but it's not the issue. I've replaced the variable substitution with hard coded variables and I get the same result. There seems to be an issue where Invoke-Command is not being run with elevated privileges, even though I'm passing credentials of user in the Domain Administrator group.

0 Votes 0 ·
MotoX80 avatar image MotoX80 BenjaminPeikes-7466 ·

Here is my code snippet to test for elevation.

 function Test-IsAdmin {
     ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
 }
    
 if (Test-IsAdmin) {
     ""
     "You are running with Administrator access."
     ""
 } else {
     ""
     "You do not have admin access."
     ""
 }


I am not familiar with Get-RDRemoteApp, but my guess would be that you are running into the infamous double hop authentication issue. Does that cmdlet reach out to additional servers? (Beyond the $server machine.)

0 Votes 0 ·

I added your code to my script block, and it does appear that I'm running with administrative access. It could be a "double hop" issue even though all of the services run on a single machine, Get-RDRemoteApp may be attempting to "connect" even though it's the same machine.

0 Votes 0 ·
RichMatheisen-8856 avatar image
0 Votes"
RichMatheisen-8856 answered MotoX80 commented

Are you use a high-availabilty setup?

 (Get-RDConnectionBrokerHighAvailability -ConnectionBroker).ActiveManagementServer

Does this work? And, if it does, do you get the name of the server you expect?

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

We do not use high-availability setup. The call Get-RDRemoteApp works when I run the same script on our Connection-Broker, in an elevated ISE.

0 Votes 0 ·
MotoX80 avatar image MotoX80 BenjaminPeikes-7466 ·

Does it work when you run it through Invoke-Command.?

Run Process Monitor and trace the ISE process. Does it reach out to other servers?

https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

0 Votes 0 ·