I am working on Windows Server 2016 (workgroup) and enabled powershell remoting on it. Only the default administrator account can perform tasks that require administrative permission such as
Get-Service
Get-DnsServerZone
and when I do that I get the access denied
error.
I can connect to it remotely with powershell and do some stuff like get-process
and so on.
remarks:
no matter what user I create (and yes
I add them to administrators group). I also added it to Remote Management Users too.
I do it with my Hyper-V sandbox VM but it simply doesn't work in my production server.
I also tried to fix it by adding specific user SID in SDDL permission in PSSessionConfiguration but it didn't work either.
Here is the PSSessionConfiguration (the username I used is despot
and server name is phantom12
)
Name : microsoft.powershell
PSVersion : 5.1
StartupScript :
RunAsUser :
Permission : NT AUTHORITY\INTERACTIVE AccessAllowed, BUILTIN\Administrators AccessAllowed, BUILTIN\Remote
Management Users AccessAllowed, phantom12\despot AccessAllowed
Name : microsoft.powershell.workflow
PSVersion : 5.1
StartupScript :
RunAsUser :
Permission : BUILTIN\Administrators AccessAllowed, BUILTIN\Remote Management Users AccessAllowed, phantom12\despot
AccessAllowed
Name : microsoft.powershell32
PSVersion : 5.1
StartupScript :
RunAsUser :
Permission : NT AUTHORITY\INTERACTIVE AccessAllowed, BUILTIN\Administrators AccessAllowed, BUILTIN\Remote
Management Users AccessAllowed
Name : microsoft.windows.servermanagerworkflows
PSVersion : 3.0
StartupScript :
RunAsUser :
Permission : NT AUTHORITY\INTERACTIVE AccessAllowed, BUILTIN\Administrators AccessAllowed, phantom12\despot
AccessAllowed
and here is the SDDL string i modified in WSMAN Service Section(the SID i added is the user SID not its Group)
O:NSG:BAD:P(A;;GA;;;LA)(A;;GA;;;BA)(A;;GA;;;S-1-5-21-xxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-1000)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
the thing that is frustrating is I can do it with my VM and change permissions but it won't work on my production server and I don't want to reinstall Windows. it's simply like they didn't get added to Administrators Group even though I added them.
Thanks you all in advance!