Powershell: Credential Failure on Off-Domain Boxes using New-PSDrive

[jackfalveyiv]

In my environment, we have created a custom Powershell script that runs on a scheduled interval. The task does the following:

• Uses an on-domain service account to run as a scheduled task on the destination server (file server)
• Uses an off-domain account on a remote DMZ server that has access to a particular custom log repository, with modify rights
• Copies all files created in the past 14 days to a local folder, and deletes anything in the source directory older than 21 days
• Logs how many files were moved to what directories in a custom log in the destination directory

When setting up the script, we are consistently able to run it as designed, however we do encounter a strange set of errors on the source server. First, here is the code:

$UserName = 'Service-Account'
$Password = Get-Content 'C:\CredFile' | ConvertTo-SecureString
$ServiceCred = New-Object System.Management.Automation.PSCredential($UserName, $Password)
$SourceIP = 'x.x.x.x'
$SourceShare1 = 'SourceShare1'
$SourceShare2 = 'SourceShare2'
$DestPath1 = 'D:\Path1\'
$DestPath2 = 'D:\Path2\
$Log = 'D:\Log.log'
$LogDate = Get-Date
$DaysBack = "-21"
$DateToDelete = $LogDate.AddDays($Daysback)
    Try
    {
    New-PSDrive -Name "AppLogs" -PSProvider "FileSystem" -Root \\$SourceIP\$SourceShare1 -Credential $ServiceCred
    $Files1 = Get-ChildItem AppLogs:\* | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-14)} -Verbose
    Copy-Item $Files1 -Destination $DestPath1 -ErrorAction Stop -Force -Verbose
    Get-ChildItem -Path \\$SourceIP\$SourceShare1\* | Where-Object {$_.LastWriteTime -lt $DateToDelete } | Remove-Item -Recurse -Verbose
    $Files1Count = $Files1.Count
    "$Files1Count files were written to $DestPath1 on $LogDate." | Out-File -FilePath $Log -Append
    }
    Catch
    {
    "No files were written to $DestPath1 on $LogDate." | Out-File -FilePath $Log -Append
    }
    Try
    {
    New-PSDrive -Name "IISLogs" -PSProvider "FileSystem" -Root \\$SourceIP\$SourceShare2 -Credential $ServiceCred
    $Files2 = Get-ChildItem IISLogs:\* | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-14)}
    Copy-Item $Files2 -Destination $DestPath2 -ErrorAction Stop -Force -Verbose
    Get-ChildItem -Path \\$SourceIP\$SourceShare2\* | Where-Object {$_.LastWriteTime -lt $DateToDelete } | Remove-Item -Recurse -Verbose
    $Files2Count = $Files2.Count
    "$Files2Count files were written to $DestPath2 on $LogDate." | Out-File -FilePath $Log -Append
    }
    Catch
    {
    "No files were written to $DestPath2 on $LogDate." | Out-File -FilePath $Log -Append
    }

    Remove-PSDrive -Name AppLogs -Verbose
    Remove-PSDrive -Name IISLogs -Verbose

As you can see, we use New-PSDrive to perform the drive mounting. For some reason, on the off-domain machine (source) we get two errors consistently in the application logs, 4776 and 4625, indicating a NULL SID. We have tested this and it only occurs at the New-PSDrive command, indicating to me that despite calling the off-domain credentials specifically to execute this task, Powershell is still passing the credentials of the account running the task first, failing, then using the correct credentials and executing as expected. The strange thing about this error is that the error logging is returning a "Unknown user name or bad password" for the on-domain account we use to run the scheduled task, yet in the script we run New-PSDrive using the off-domain account only. We do not understand why, despite the script expressly using separate credentials, that the destination machine still attempts to use credentials it is running the task as. Despite these errors, the script executes successfully, as intended, despite these errors.

For the time being, we decided to create a mirrored local account on the destination server, which the task now runs as. This has alleviated these errors completely, however we would rather not have mirrored local accounts. Has anyone else encountered this situation, and if so is there a better way to approach it?

[iSazonov]

@jackfalveyiv Please share $PSVersionTable

[jackfalveyiv]

Name                           Value
----                           -----
PSVersion                      5.1.18362.145
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.18362.145
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[iSazonov]

@jackfalveyiv The repository is for PowerShell Core. You can report Windows PowerShell issues to UserVoice site or use Windows 10 feedback tool.

If you can reproduce the issue with latest PowerShell Core 7 build you can report in the repository.

[jackfalveyiv]

OK, after running the same code in Powershell Core 7 I am experiencing the same issue:

Name                           Value
----                           -----
PSVersion                      7.0.0-preview.5
PSEdition                      Core
GitCommitId                    7.0.0-preview.5
OS                             Microsoft Windows 10.0.18362
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[iSazonov]

@jackfalveyiv Thanks for repo on PowerShell Core.

Does the script work well in interactive session?

[jackfalveyiv]

It does, and still generates the 4776 and 4625 errors.

[jackfalveyiv]

I didn't mention this before, but we did manage to narrow this down to the specific New-PSDrive cmdlet since posting this error. Without any of the copying cmdlets or measurement of directories, executing New-PSDrive is triggering the errors.

[iSazonov]

We use P/Invoke https://docs.microsoft.com/en-us/windows/win32/api/winnetwk/nf-winnetwk-wnetaddconnection2a
I guess this is a feature of this function.

WNetAddConnection2A function (winnetwk.h) - Win32 apps

The WNetAddConnection2 function makes a connection to a network resource and can redirect a local device to the network resource.

[MSIH]

@iSazonov How do you use in Powershell. please provide an example. Thanks

[iSazonov]

@MSIH I did not understand your question.

[emixam360]

Hello

I am facing the same issue with the New-PSDrive command.
The command is executed with success on a Workgroup Computer with a local account but using a Credential parameter from a domain account

New-PSDrive -PSProvider FileSystem -Name 'REPORTS' -Root '\\SERVER.domain.local\Data\Reports' -Credential (get-credential)

Events 4776 and 4625 are generated on the remote server with failed login from the local account.