Remote PowerShell between LAN and DMZ/Exchange Edge Server

Thanks for the detailed information. It looks like you've covered most of the bases. Given that Negotiate should work and you've verified the settings, let's try a few more troubleshooting steps:

1. Ensure that the WinRM listener is configured correctly on the Edge Server. Run the following command on the Edge Server:

winrm enumerate winrm/config/listener

You should see a listener configured for HTTP (port 5985) or HTTPS (port 5986). If not, you can create one:

winrm create winrm/config/Listener?Address=*+Transport=HTTP

2. Verify that the WinRM service allows Negotiate authentication. Run the following command on the Edge Server:

winrm get winrm/config/service

Ensure that Auth includes Negotiate. If not, you can set it:

winrm set winrm/config/service/auth @{Negotiate="true"}

3. Ensure that the local group policy on the Edge Server allows remote management. You can configure this in the Local Group Policy Editor (gpedit.msc):

• Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service.
• Enable Allow remote server management through WinRM.

4. Even though the Edge Servers are not part of a domain, try using the FQDN or IP address instead of just the server name in your Enter-PSSession command:

Enter-PSSession -ComputerName <FQDN_or_IP> -Credential $UserCredential -Authentication Negotiate

5. If your client machine is not directly connected to the Edge Server, there might be a double-hop issue. Ensure that CredSSP is enabled if this is the case:

Enable-WSManCredSSP -Role Client -DelegateComputer <ServerName>

Hi Jake,

here is what I got:

PS C:\Windows\system32> winrm enumerate winrm/config/listener
Listener [Source="GPO"]
    Address = *
    Transport = HTTP
    Port = 5985
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = 127.0.0.1, <IP-Address>, <IP-Address>, ::1
Listener
    Address = *
    Transport = HTTPS
    Port = 5986
    Hostname = <ServerName>
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint = e5b1e7a9dc77caa142c54c729d83b2902b8a25e4
    ListeningOn = 127.0.0.1, <IP-Address>, <IP-Address>, ::1

PS C:\Windows\system32> winrm get winrm/config/service
Service
    RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
    MaxConcurrentOperations = 4294967295
    MaxConcurrentOperationsPerUser = 1500
    EnumerationTimeoutms = 240000
    MaxConnections = 300
    MaxPacketRetrievalTimeSeconds = 120
    AllowUnencrypted = false [Source="GPO"]
    Auth
        Basic = false [Source="GPO"]
        Kerberos = true
        Negotiate = true
        Certificate = false
        CredSSP = false
        CbtHardeningLevel = Relaxed
    DefaultPorts
        HTTP = 5985
        HTTPS = 5986
    IPv4Filter = * [Source="GPO"]
    IPv6Filter = * [Source="GPO"]
    EnableCompatibilityHttpListener = false
    EnableCompatibilityHttpsListener = false
    CertificateThumbprint
    AllowRemoteAccess = true [Source="GPO"]

PS C:\WINDOWS\system32> Enable-WSManCredSSP -Role Client <ServerName>
CredSSP Authentication Configuration for WS-Management
CredSSP authentication allows the user credentials on this computer to be sent to a remote computer. If you use CredSSP authentication for a connection to a malicious or
compromised computer, that computer will have access to your user name and password. For more information, see the Enable-WSManCredSSP Help topic.
Do you want to enable CredSSP authentication?
[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"):
cfg         : http://schemas.microsoft.com/wbem/wsman/1/config/client/auth
lang        : en-US
Basic       : Basic
Digest      : Digest
Kerberos    : true
Negotiate   : true
Certificate : true
CredSSP     : true

In the end I'm still getting:

Enter-PSSession -ComputerName <ServerName> -Credential $UserCredential -Authentication Negotiate
Enter-PSSession : Connecting to remote server <ServerName> failed with the following error message : Access is denied. For more information, see the
about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ Enter-PSSession -ComputerName <ServerName> -Credential $UserCredential - ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (<ServerName>:String) [Enter-PSSession], PSRemotingTransportException
    + FullyQualifiedErrorId : CreateRemoteRunspaceFailed

Thanks for the detailed information. It looks like you've done a thorough job troubleshooting so far. Given the "Access is denied" error and the steps you've already taken, let's try a few more specific checks and configurations:

1. Ensure that the user account you're using is a member of the local Administrators group on the Edge Server. You can check this by running:

net localgroup Administrators

2. Explicitly set the permissions for the WinRM service to allow the user account. Run the following command on the Edge Server:

winrm configSDDL default

This will display the current permissions. Ensure that your user account has the necessary permissions. You can modify the permissions using the Set-ACL cmdlet if needed.

3. Ensure that the client machine's TrustedHosts list includes the Edge Server and vice versa. On the Edge Server, add the client machine to the TrustedHosts list:

Set-Item WSMan:\localhost\Client\TrustedHosts -Value "<ClientMachineName>"

4. Sometimes, using the IP address instead of the hostname can bypass DNS resolution issues. Try connecting using the IP address of the Edge Server:

Enter-PSSession -ComputerName <EdgeServerIP> -Credential $UserCredential -Authentication Negotiate

5. Try using a different user account that has administrative privileges on the Edge Server to rule out any account-specific issues.

Example Command with IP Address

Here's an example of how you might use Enter-PSSession with the IP address:

Enter-PSSession -ComputerName <EdgeServerIP> -Credential $UserCredential -Authentication Negotiate