Batch script works fine but fails when executed via PowerShell Remoting
I have the following batch script on a Windows 2008 R2 server:
@echo off
djoin.exe /provision /domain my.domain.com /machine test /savefile savefile.txt
echo %ERRORLEVEL%
If I run the script on the server itself, either using the command line or using PowerShell, it works fine and returns "0".
The problem is that I need to execute it from a remote computer, so I do the following (example for testing):
Invoke-Command -ComputerName remotehost -ScriptBlock {.\script.cmd}
The output is "-1073740940" which is probably the error code C0000374, which may have something to do with heap corruption.
This seems to be a problem with the djoin command itself. I can comment out djoin and run other binaries like ping without issue using the same Invoke-Command.
Keeping in mind that the script works fine when running PowerShell on the target machine, what kind of problems can arise from the remote control action?
In both cases, the script is executed with the same privileges using my account, which is a member of the domain admins. I doubt this is a permissions issue and am not sure where else to look.
[edit]
Everything remains. This is either a bug in djoin, or some obscure problem in the communication between djoin and PS removal.
I was able to run djoin directly on the client using "runas / netonly ..." to provide the domain credentials. This is a very messy solution (and I have yet to figure out how to get the exit status of the process started by runas) but gets the job done.
source to share
This is almost certainly a classic double-pass authentication problem. Remember, when you use PowerShell Remoting, you are using one of these hops. Anything you do on that remote machine that is accessing the third remote machine is unlikely to work if it requires authentication.
To work around this, you can use an authentication method that allows you to Delegate credentials , such as CredSSP. This is a little more than just changing the authentication type, as you have to make changes on the client side and the server side of the transaction. See this blog post on MSDN, "Uninstalling PowerShell" and "Double-Hop" and "Hello Scripting Guy!" post, Enable PowerShell "Second-Hop" Feature Using CredSSP .
source to share