Access Denied Error When You Try to Remote Exchange Server on the Local Host

Question

I am trying to establish a PowerShell session to run multiple Exchange commands on an Exchange server on a local host. I keep getting the following error:

New-PSSession : [<HOSTNAME>] Connecting to remote server <HOSTNAME> failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic. At line:1 char:12 + $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'h ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotin gTransportException + FullyQualifiedErrorId : AccessDenied,PSSessionOpenFailed 

My code is to copy a copy from the Microsoft Technical Article . It works with a remote machine, but at any time when I am targeting the machine I'm running with, I get the above error.

What I have tried so far:

• Confirmed help about_remote_troubleshooting . Nothing related to Access Denied errors worked.
• Target remote computers using the same credentials as the Access Denied error received. (Connected without problems)
• Checked that my PowerShell session is running as an administrator. (This is true)
• Checked that Exchange Management Shell starts successfully. (This is true)
• Tried without credentials to make sure this works. (This is not true)
• Checked net use and net session to make sure I didn't have weird multiple connections with the same credentials. (I did not see anything to indicate this)
• I tried this both from the script that causes the problems, and by manually entering commands into the powershell console. (got the same results in both directions. Yay for consistency)
• Tried this on multiple systems. (Same result everywhere)

Some quick notes:

• This is Exchange 2013, running on Windows Server 2012. This is a basic installation, just a test environment in which there is very little data and minimal configuration, in addition to installing and enabling remote access.
• The credentials used were for the domain administrator, who also has the necessary Exchange permissions to do everything I need. Ie, as long as I aim at a car that is not the one I'm running with, I have no problem and nothing else changes in how I connect. In addition, it is a test domain in which the domain administrator’s access was not limited or changed in any way, so it should have full and full access to everything.

The specific commands I entered are:

 $cred = Get-Credential $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'http://<HOSTNAME>/Powershell' -Credential $cred 

Is connecting to a local host this what can I do? Or is it just not supported?

Now I am in complete loss. Any help, even pointing me in the right direction, would be greatly appreciated.

EDIT: I have to add, I tried connecting to this local host from another machine using the same commands as above, and worked without problems. Thus, I do not think this is a local configuration problem.

Answer 1

So, I came across a solution at the end of last week. This seems to be related to the authentication used. I left the "-Authentication" parameter blank, intending to give the New-PSSession command the ability to determine which method would be the best.

Apparently, the default is the Negotiate authentication method, which will select Kerberos for the remote machine, but otherwise choose NTLM (or at least that was my observed / assumed behavior). See this description of Microsoft authentication methods.

Specifying a specific authentication method (both "Kerberos" and "Basic" worked, "Negotiate" did not do this, I did not redo it too much) fixes the problem and allows me to connect to the local Exchange instance.

So instead:

 $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'http://<HOSTNAME>/Powershell' -Credential $cred 

Do it:

 $session = New-PSSession -Authentication Kerberos -ConfigurationName Microsoft.Exchange -ConnectionUri 'http://<HOSTNAME>/Powershell' -Credential $cred 

Why did it work? I have no idea. I will leave it to people who know more than me to explain it.

Answer 2

If you are just trying to create a session on the same computer as your current session, skip the URI.

 $cred = Get-Credential $session = New-PSSession -ConfigurationName Microsoft.Exchange -Credential $cred 

This will create a new session on the local host with which you can connect and use as needed.