我有一个Windows服务,定期通过WsManConnectionInfo
/RunspaceFactory
在远程计算机上运行PowerShell脚本(按照这篇文章的步骤执行:使用C#远程执行PowerShell命令):
var connectionInfo = new WSManConnectionInfo(false, server, 5985, "/wsman",
"http://schemas.microsoft.com/powershell/Microsoft.PowerShell",
cred)
{
OperationTimeout = 4*60*1000,
OpenTimeout = 1*60*1000
};
using (var runSpace = RunspaceFactory.CreateRunspace(connectionInfo))
{
runSpace.Open();
using (var p = runSpace.CreatePipeline())
{
p.Commands.AddScript(script);
var output = p.Invoke();
...
}
}
现在,如果我使用管理员账户运行Windows服务,一切正常。但是如果我使用LocalSystem账户运行服务,则会出现以下异常;
System.Management.Automation.Remoting.PSRemotingTransportException:
Connecting to remote server NOSRVDEV02 failed with the following error message :
WinRM cannot process the request. The following error with
errorcode 0x8009030d occurred while using Negotiate authentication:
A specified logon session does not exist. It may already have been terminated.
Possible causes are:
-The user name or password specified are invalid.
-Kerberos is used when no authentication method and no user name are specified.
-Kerberos accepts domain user names, but not local user names.
-The Service Principal Name (SPN) for the remote computer name and port does not exist.
-The client and remote computers are in different domains and there is no trust between the two domains.
After checking for the above issues, try the following:
-Check the Event Viewer for events related to authentication.
-Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
Note that computers in the TrustedHosts list might not be authenticated.
-For more information about WinRM configuration, run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
at System.Management.Automation.Runspaces.AsyncResult.EndInvoke()
at System.Management.Automation.Runspaces.Internal.RunspacePoolInternal.EndOpen(IAsyncResult asyncResult)
at System.Management.Automation.RemoteRunspace.Open()
...
注意:这与 WSManConnectionInfo
的凭据无关——仅涉及服务属性中“登录”选项卡中的帐户设置。
我不想给予服务管理员权限。任何想法为什么LocalSystem用户无法登录?
附加信息:
- 远程计算机不是域成员。
- 我尝试使用IP地址和主机名进行连接(两者都在本地计算机的
TrustedHosts
中列出)。
编辑:更多信息(摘要注释):
- 本地计算机:Windows 7 Ultimate 64位(在Windows 8框中的虚拟机)。
- 远程计算机:Windows Server 2008R2 Datacenter 64位。
- 我们不想更改服务用户帐户的主要原因是,这是对已经部署在许多客户端(客户)上的旧服务的更新。
- 该服务还会访问本地计算机上的Windows注册表和文件系统,因此将用户帐户设置为像NetworkService这样的更受限制的东西只会带来不同的问题。