WinRM issue with Install-DbaInstance #7132
Unanswered
AlexDBA012
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Hi
I have a build script that installs SQL on new SQL server using Install-DBAInstance. The command line I use is
Install-DbaInstance -sqlinstance $virtualmachine -version 2017 -credential $credADM -path "\server1\SQL Server\SQL2017\SQL2017_ENT_x64" -ConfigurationFile "\server1\SQL Server\SQL2017\SQL2017_ENT_x64\ConfigurationFile.ini" -confirm:$false
The credential is a domain and local admin so there are no permission issues there.
This used to run ok but now I get
WARNING: [08:31:54][Install-DbaInstance] Failed to enumerate files in \server1\SQL Server\SQL2017\SQL2017_ENT_x64 | Connecting to remote
server SQLServer1.domain failed with the following error message : The WinRM client cannot process the request. A computer policy does not allow
the delegation of the user credentials to the target computer because the computer is not trusted. The identity of the target computer can be
verified if you configure the WSMAN service to use a valid certificate using the following command: winrm set winrm/config/service
'@{CertificateThumbprint=""}' Or you can check the Event Viewer for an event that specifies that the following SPN could not be created:
WSMAN/. If you find this event, you can manually create the SPN using setspn.exe . If the SPN exists, but CredSSP cannot use Kerberos
to validate the identity of the target computer and you still want to allow the delegation of the user credentials to the target computer, use
gpedit.msc and look at the following policy: Computer Configuration -> Administrative Templates -> System -> Credentials Delegation -> Allow Fresh
Credentials with NTLM-only Server Authentication. Verify that it is enabled and configured with an SPN appropriate for the target computer. For
example, for a target computer name "myserver.domain.com", the SPN can be one of the following: WSMAN/myserver.domain.com or WSMAN/*.domain.com. Try
the request again after these changes. For more information, see the about_Remote_Troubleshooting Help topic.
I've tried running Enable-psremoting -force, but that doens't work. If install DBAtools on the new server and run the commnad line it works fine.
Any Ideas?
Beta Was this translation helpful? Give feedback.
All reactions