从C＃调用Exchange命令行管理程序时出现连接错误

Question

I get a weird exception after solved SSL certificate issue. Please help! My code: PSCredential credential = new PSCredential("domain\\administrator", securePwd);

    WSManConnectionInfo connectionInfo = new WSManConnectionInfo(new Uri("https://www.xxx.com/powershell"), "http://schemas.microsoft.com/powershell/Microsoft.Exchange", credential);
    Runspace runspace = System.Management.Automation.Runspaces.RunspaceFactory.CreateRunspace(connectionInfo);
    connectionInfo.AuthenticationMechanism = AuthenticationMechanism.Basic;
    using (runspace)
    {
        Collection<PSObject> psObject = GetUserInformation(10, runspace);

    }

public Collection GetUserInformation(int count, Runspace runspace) { using (PowerShell powershell = PowerShell.Create()) {

        powershell.AddCommand("Get-Users");
        powershell.AddParameter("ResultSize", count);

        runspace.Open();//**error happens**

        powershell.Runspace = runspace;

        return powershell.Invoke();
    }
}

Error message: "Connecting to remote server failed with the following error message : The WinRM client cannot process the request. The WinRM client tried to use Negotiate authentication mechanism, but the destination computer (www.xxx.com:443) returned an 'access denied' error. Change the configuration to allow Negotiate authentication mechanism to be used or specify one of the authentication mechanisms supported by the server. To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain. To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password."

I use basic authentication, and provide username and credential, why it says "tried to use Negotiate authentication mechanism"?

Answer 1

First, try to set the connectionInfo.AuthenticationMechanism property BEFORE you create your runspace. So swap the order of lines 2 and 3 on your first code snippet.

If that does not fix it, make sure Basic Authentication is enabled on the PowerShell website.

To do this you need to go to the IIS Manager, Sites, Default Website, PowerShell, select the Authentication Feature, and enable Basic Authentication.

If Basic Authentication is not an option on the Authentication feature page, you need to install it by going to the Server Manager, select the Web Server role, say "Add Role Services", under the Security node in the treeview, select Basic Authentication.

Answer 2

Using Basic Authentication is not allowed in this scenario unless explicitly configured on the server... you could enable it server-side or use Kerberos/NTLM...

For details see http://technet.microsoft.com/en-us/library/dd351136.aspx and http://technet.microsoft.com/en-us/library/dd347642.aspx

Answer 3

I can summarize the steps to make Basic authentication work even from computers outside the domain:

• Set-ExecutionPolicy to Unrestricted on both Client and Server
• configure properly the TrustedHosts on client and server
• enable Basic authentication on client and server
• make sure Basic Authentication Role is installed under Security for the Web Server (IIS)
• enable Basic Authentication for the PowerShell virtual directory
• use HTTP, not https to access the server.

Here is the working code as well:

PowerShell powershell = PowerShell.Create();
String pass = "password";
SecureString passSecure = new SecureString();
foreach (char c in pass.ToCharArray())
{
    passSecure.AppendChar(c);
}
PSCredential cred = new PSCredential("user", passSecure);

string schemaURI = "http://schemas.microsoft.com/powershell/Microsoft.Exchange";
Uri connectTo = new Uri("http://192.168.69.116/powershell/");            
WSManConnectionInfo connectionInfo = new WSManConnectionInfo(connectTo, schemaURI, cred);
connectionInfo.MaximumConnectionRedirectionCount = 5;
connectionInfo.AuthenticationMechanism = AuthenticationMechanism.Basic;
//connectionInfo.AuthenticationMechanism = AuthenticationMechanism.Default;
connectionInfo.SkipCACheck = true;
connectionInfo.SkipCNCheck = true;
connectionInfo.SkipRevocationCheck = true;
Runspace remoteRunspace=null;
try
{
   remoteRunspace = RunspaceFactory.CreateRunspace(connectionInfo);
   remoteRunspace.Open();
}
catch (Exception err)
{
    //Handle error 
}