无法使用C＃远程运行Admin PowerShell命令

Question

I am trying to run a remote PowerShell script to query and kill the tasks running in a specific session:

string hostname = "XADCG.mydomain.co.uk";
string script = "$pw = convertto-securestring -AsPlainText -Force -String password123 " + Environment.NewLine +
                "$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist \"DOMAIN1\\zzkillcitrix\",$pw" + Environment.NewLine +
                "$sessions = New-PSSession -ComputerName " + hostname + " -credential $cred" + Environment.NewLine +
                "Invoke-Command -session $sessions -ScriptBlock {taskkill /s xa7-11.mydomain.co.uk /PID 26208 /F}" + Environment.NewLine +
                "Remove-PSSession -Session $sessions" + Environment.NewLine +
                "exit";

// Create and open runspace  
Runspace runspace = RunspaceFactory.CreateRunspace();
runspace.Open();

// Create piepeline and feed it the script text
Pipeline pipeline = runspace.CreatePipeline();
pipeline.Commands.AddScript(script);

Collection<PSObject> results = new Collection<PSObject>();
try
{
    results = pipeline.Invoke();
    var error = pipeline.Error.Read();
}
catch (Exception ex)
{
    results.Add(new PSObject((object)ex.Message));
}

runspace.Close();

If I call tasklist , I get the normal, expected result in the results variable (the list of processes running on the server XADCG)

However, if I try running a query against another session (for example query session user.name /server:xa11.mydomain.co.uk ), my results variable returns empty

After checking which errors are output, I have found the following:

taskkill /s xa11.mydomain.co.uk /pid 5876 /F
    {ERROR: Logon failure: unknown user name or bad password.}

query session user.name /server:xa11.mydomain.co.uk
    {Error 5 getting sessionnames}

tasklist /s xa7-11.mydomain.co.uk /fi \"SESSION EQ 4\"
    {ERROR: Logon failure: unknown user name or bad password.}

Which obviously makes it seem that I am using the wrong username / password, but I am 100% sure that these are set correctly in the $cred variable

I can also confirm that the account zzkillcitrix does have permission to run these queries remotely (I am able to execute all of these commands by calling Process.Start with a runas for this user)

Is there somewhere else I need to set these credentials, or am I missing something else from my script?

Appreciate any help with this

Answer 1

I was able to resolve this with the following script:

string hostname = "SERVER.Domain.co.uk";

string script = "$pw = convertto-securestring -AsPlainText -Force -String \"PASSWORD\"" + Environment.NewLine +
                "$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist \"Domain1\\zzkillcitrix\",$pw" + Environment.NewLine +
                "$sessions = New-PSSession -ComputerName " + hostname + " -credential $cred" + Environment.NewLine +
                "Invoke-Command -session $sessions -ScriptBlock {taskkill /s xa7-11.Domain1.co.uk /pid 23736 /U Domain1\\zzkillcitrix /P PASSWORD /F }" + Environment.NewLine +
                "Remove-PSSession -Session $sessions" + Environment.NewLine +
                "exit";

Runspace runspace = RunspaceFactory.CreateRunspace();
runspace.Open();

Pipeline pipeline = runspace.CreatePipeline();
pipeline.Commands.AddScript(script);

Collection<PSObject> results = new Collection<PSObject>();
try
{
    results = pipeline.Invoke();
    var errors = pipeline.Error.Read(pipeline.Error.Count);
    foreach (var error in errors)
    {
        var y = error;
    }
}
catch (Exception ex)
{
    results.Add(new PSObject((object)ex.Message));
}

runspace.Close();

So I needed to authenticate when creating New-PSSession with my $sessions variable, and then authenticate again when calling the actual command:

"Invoke-Command -session $sessions -ScriptBlock {taskkill /s xa7-11.Domain1.co.uk /pid 23736 /U Domain1\\zzkillcitrix /P PASSWORD /F }" + Environment.NewLine +

I still don't understand why I am able to run that command manually from PowerShell from that same server without providing credentials, but it makes sense in that I am remoting onto the server with $sessions and then remoting back out, into the session in question when including the authentication details in the ScriptBlock.