We’ve installed the Fresh PowerShell App for Automation, but due to the Kerberos Double Hop issue, we cannot query any other systems beyond the powershell remoting host.
As there are contradictory articles from Microsoft as to whether or not Kerberos Delegation works with PowerShell Remoting (our experience is that it doesn’t), we’re using CredSSP instead. This allows us not only to query and manage Active Directory objects, but also to query other remote systems’ APIs from within a PowerShell script.
To allow us to use this with Fresh, to allow us to automate such things as user creation, could you add in an option for ‘Authentication’ in the PowerShell Orchestration App?
When invoking a remote in PowerShell, the syntax we’re using is:
Invoke-Command -ComputerName <server fqdn> -Credential $MyCredential -Authentication Credssp {<PowerShell Commands>}
The standard options for use with the Authentication parameter are:
- Basic
- Credssp
- Default
- Digest
- Kerberos
- Negotiate
- NegotiateWithImplicitCredential
I’d suggest the default setting would be default.
For AD queries, although you currently suggest running the PowerShell session directly on Domain Controllers, this isn’t allowed in some security-conscious environments.
