PowerShell-在远程计算机/计算机上调用命令

Question

有很多关于主题的论坛/材料，但似乎无法解决我的问题。

我正在尝试从主服务器（SRV01）执行脚本，该脚本将清除辅助服务器（SRV02，SRV03）上的临时文件夹。

这里是脚本：

#Set the machines on the network to run the script on
$VDST = @("SRV02", "SRV03")

#Folder locations to clean out
$TempFolder = @("C:\Windows\Temp\*", "C:\Documents and Settings\*\Local Settings\temp\*")

#This function actually performs the clean up operation
Function executeCleanUp
    {
        $TempFolder = $args[0]
        $machineNames = $args[2]

        ForEach($machine in $machineNames){

            Get-PSSession -ComputerName $machine | Format-Table -Property ComputerName, InstanceID

            Write-Host 'Starting Clean Up...'

            #Loop through the sub folders in the registry location
            ForEach($folderLocation in $TempFolder)
            {
                $StrInput = 'Remove-Item -Path ' + $folderLocation + ' -Force -Recurse -ErrorAction SilentlyContinue'

                $action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument $StrInput 

                Register-ScheduledTask -Action $action -TaskName "CleanUp"

                Start-ScheduledTask -TaskName "CleanUp"

                Unregister-ScheduledTask -TaskName "CleanUp" -Confirm:$false -ErrorAction SilentlyContinue

            }
    }

#Execute Script on specified machines - provided in array above
Invoke-Command -ComputerName $VDST -ScriptBlock ${function:executeCleanUp} -ArgumentList $TempFolder, $VDST

运行上述命令后，出现错误：

指定的登录会话不存在

所以，我遇到了一个建议执行以下操作的论坛：

#Remote Server (VDI)
Enable-WSManCredSSP -Role server

#Expected Output
#This computer is configured to receive credentials from a remote client computer.

#Local Machine
Enable-WSManCredSSP -Role Client -DelegatedCredentials 'SRV01'

#Expected Output
#The machine is configured to allow delegating fresh credentials to the following target(s): wsman/SRV01.

#Local Machine
#Open gpedit.msc 
#Browse to Computer Configuration > Administrative Templates > System > Credentials Delegation. 
#Double-click "Allow delegating fresh credentials with NTLM-only Server Authentication"
#Enable the setting 
#Add the build server to the server list as WSMAN/BuildServerName.

#Example Execution:
#Invoke-Command -ComputerName <REMOTE_COMPUTER_NAME> -Authentication CredSSP -Credential <USERNAME> -ScriptBlock { #code}

我已经完成了所有这些，但是现在我得到了错误：

计算机策略不允许委派用户目标计算机的凭据

此外，我假设这行

WSMAN / BuildServerName

应写成

WSMAN / SRV02

Answer 1

出现2跳身份验证问题，因为您试图在远程会话中列出远程会话Get-PSSession -ComputerName $machine | Format-Table -Property ComputerName, InstanceID

如果只想清除远程服务器上的某些文件，则下面的代码应该不需要CredSPP。

设置-ErrorAction SilentlyContinue将使故障排除更加困难，在尝试删除文件之前更容易检查文件是否存在。

$TempFolder = $args[0]
$ComputerArray = "SRV02","SRV03"
$ScriptBlock =
{

    foreach ($Folder in $TempFolders)
    {
        if (Test-Path -Path $TempFolder)
        {
            Remove-Item -Path $Folder -force
        }
    }
}

Invoke-Command -ComputerName $ComputerArray -ScriptBlock $ScriptBlock -ArgumentList $TempFolder

错误答案：

您的问题是两跳身份验证。您不能使用默认的Windows设置嵌套远程会话。虽然这不是最佳实践，但是您可以启用CredSSP来​​绕过此问题。

https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-security-support-provider

https://docs.microsoft.com/en-us/powershell/module/microsoft.wsman.management/enable-wsmancredssp?view=powershell-7

您是否可以登录SVR01来运行脚本或从您自己的计算机对目标计算机运行脚本？