Using powershell Invoke-Command to install applications in C:

I want to install anydesk on remote machine after creating the virtual machine. Problem is that with remote powershell commands, I am not able to install that and get access denied error.

Invoke-Command -ComputerName $RemoteMachine -Credential $Cred ` -ScriptBlock { \\10.1.1.3\share\apps\TOOLS\AnyDesk.exe --install C:\ --start-with-win } 

Says:

Access is denied + CategoryInfo : OperationStopped: (:) [], UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException + PSComputerName : 10.1.1.40

Also, I tried using Start-Process with the -Verb option as below

 Invoke-Command -ComputerName $RemoteMachine -Credential $Cred -ScriptBlock { Start-Process -FilePath "\\10.1.1.3\share\apps\TOOLS\AnyDesk.exe" -ArgumentList "--install C:\ --start-with-win" -Verb RunAs } 

However, I get the same error:

Access is denied + CategoryInfo : NotSpecified: (:) [Start-Process], UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.St artProcessCommand + PSComputerName : 10.1.1.40

Any way to fix that?

UPDATE:

In the following complete code, I am able to pass the user and password to the remote machine and run a dir command prior to accessing the shared folder on \\10.1.1.3. I also have to emphasis that the shared folder is public. If I manually login to my remote machine (10.1.1.40), I am able to open \\10.1.1.3\share\apps\Tools without any password.

$RemoteMachine = "10.1.1.40"
Set-Item WSMan:\localhost\Client\TrustedHosts -Value $RemoteMachine
$Username = 'user'
$Password = ' '
$pass = ConvertTo-SecureString -AsPlainText $Password -Force
$Cred = New-Object System.Management.Automation.PSCredential -ArgumentList $Username,$pass
Invoke-Command -ComputerName $RemoteMachine -Credential $Cred -ScriptBlock { & { dir Start-Process -FilePath "\\10.1.1.3\share\apps\TOOLS\AnyDesk.exe" -ArgumentList "--install C:\ --start-with-win" -Verb RunAs } }

And the output is

PS C:\Windows\system32> C:\Users\user\Desktop\anydesk.ps1 Directory: C:\Users\user\Documents
Mode LastWriteTime Length Name PSComputerName
---- ------------- ------ ---- --------------
d----- 1/7/2021 12:48 AM PowerShell 10.1.1.40
d----- 1/7/2021 12:48 AM WindowsPowerShell 10.1.1.40
Access is denied + CategoryInfo : NotSpecified: (:) [Start-Process], UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.St artProcessCommand + PSComputerName : 10.1.1.40

2 Answers

As specified in the other answer about the double hop being the issue, you would indeed to need to configure the delegation and trusts per one of those methods to get this to work the way you are trying it here.

The problem is the remote machine is trying to execute the executable file from a UNC path and the credential used is running into the double hop issue and that not being configured for delegation, etc.

You can workaround this issue by first copying the file from the UNC path to the remote machine's local file system so the install will move forward when it's invoked from there instead.

I've written a couple PowerShell script variations using explicit credentials that don't require configuring any delegation or trusts to get the executable file to execute on the remote machine. This will allow it to move forward with the install process per the workaround solution.

PowerShell Scripts Notes

• While the PowerShell logic variations provided here use Get-Credential to set the $Cred variable, making that use System.Management.Automation.PSCredential is trivial and I will assume you got that under control to make work how you need it for your task(s).

• Also note that these solutions use the -Wait switch with Start-Process so it will wait for the install to complete and then remove the executable file from the local machine afterwards for cleanup. Perhaps this is not an issue or you can remove the -wait and do the cleanup later to help speed up the process overall.

Workaround PowerShell (Variation 1)

Note: This variation assumes the account you are executing the PowerShell from already has access to the C$, or any other shared folder on the remote machine you are copying the executable file to, and the credential is for permission to execute and install that file on the remote machine only.

$cred = Get-Credential "domain\username";
$RemoteMachine = "10.1.1.40";
$PackageName = "AnyDesk.exe";
$SourceDir = "\\10.1.1.3\share\apps\TOOLS";
$PackageNameDir = "$SourceDir\$PackageName";
$Pkg = "$SourceDir\$PackageName";
Copy-Item $Pkg -Destination "\\$RemoteMachine\C$";
Invoke-Command -ComputerName $RemoteMachine -ScriptBlock { Start-Process -FilePath "C:\$using:PackageName" -ArgumentList "--install C:\ --start-with-win" -Wait; } -Credential $cred;
Remove-Item "C:\$PackageName" -Force;

Workaround PowerShell (Variation 2)

Note: This variation assumes the credential you are using is for both accessing the C$, or any other shared folder on the remote machine you are copying the executable file to, and for permission to execute and install that file on the remote machine.

$cred = Get-Credential "domain\username";
$RemoteMachine = "10.1.1.40";
$PackageName = "AnyDesk.exe";
$SourceDir = "\\10.1.1.3\share\apps\TOOLS"
$PackageNameDir = "$SourceDir\$PackageName";
$Pkg = "$SourceDir\$PackageName";
New-PSDrive -Name x -PSProvider FileSystem -Root "\\$RemoteMachine\C$" -Credential $cred
Copy-Item $Pkg -Destination "\\$RemoteMachine\C$";
Remove-PSDrive -Name x;
Invoke-Command -ComputerName $RemoteMachine -ScriptBlock { Start-Process -FilePath "C:\$using:PackageName" -ArgumentList "--install C:\ --start-with-win" -Wait } -Credential $cred;
New-PSDrive -Name x -PSProvider FileSystem -Root "\\$RemoteMachine\C$" -Credential $cred
Remove-Item "C:\$PackageName" -Force;
Remove-PSDrive -Name x;

Supporting Resources

• Get-Credential
• Copy-Item
• Invoke-Command
• Get-PSDrive
• Remove-Item

I suspect the problem is that the remote session doesn't have your password stored, and is unable to connect to the \\10.1.1.3 server anonymously (SMB servers always require authentication, unlike NFS).

You need to configure Invoke-Command to 'delegate' your credentials (password, Kerberos ticket) to the remote server. This article has several methods – although it mostly talks about nested Invoke-Commands, everything still applies to SMB file-share access as well.

• Making the second hop in PowerShell Remoting