Best Way to Setup Macro/Script/Tool to Run Remotely Using Alternate Credentials

Resolved

Best Way to Setup Macro/Script/Tool to Run Remotely Using Alternate Credentials

avatar

Hello,

Looking for some help here. We've just started to play around with the macro/script/tool functionality which seems like it could be great! The only issue is, we have separate accounts for privileged and normal. So although I login to my workstation w/ my normal account (and thus that is the account I run RDM under), the vast majority of the sessions that I connect to are connected with alternate credentials (either my privileged account in this domain, or another domain, depending on the entry). The workflow is similar for my colleagues.

I've tried a couple different ways of how to get a script to run with the creds I used to connect to the session but nothing seems to work so far. In a command line or PowerShell, I can set it to "run as another user" however there is nowhere to actually set what user to run as. How does this setting work? I even see the "netonly" option (equivalent to the "runas" command "/netonly" CLI option I presume) but again, without being able to specify a user, this doesn't help much.

In the PowerShell (local) script I see there is an option to run with session creds. So I thought - perfect, that's exactly what I need! But, alas, it doesn't work =( Basically it just launches a local PS session on my machine. And furthermore, the command fails, even when I use the parameter with a default value of $HOST$ which should seemingly resolve to the hostname of the session I'm running it against, I would think? But the error indicates that no value was passed (i.e. the command was restart-computer -computername ""). Of course I could type the name in manually but then that sort of defeats the purpose of being able to easily execute it against a session. And ideally, I'd like to be able to execute this against multiple sessions at a time if needed (via right-click the sessions -> macro script tool menu) - not sure how I'd do that without manually entering each name in the parameter prompt though.

I know there are a couple threads related to this but nothing seemed to have a concrete answer. Can anyone provide some guidance here of what setup I could use to get this working please? My goal is a macro I can execute (via right-click menu) against one or more sessions to execute one or more commands (to start with, something very simple like a shutdown /r CMD command or restart-computer PowerShell command).

One more thing I will add - if I was doing this manually from the command line, in PowerShell I'd just use the -Credential parameter that most, but not all commands have. For the commands that don't have that, or for CMD commands, I'd run it in a shell running under alternate credentials via runas /netonly (which the script entry appears to have as an option - but again, nowhere to specify the username). Maybe this information will help someone who knows RDM better than me to come up with a solution that will work =)

Best regards! Any help is much appreciated!

David Willis

All Comments (17)

avatar

Hello David,

Thank you for reaching out to the Devolutions support team.

Anything that will be related to MMC will need to be run with a WinRM configuration.

This is a requirement by Microsoft.

Note that if you already have this configuration, you can use the Macros/Scripts/Tools tab from RDM directly under the RDP session.

(Note that it will take the credentials from your RDM connection, not the RDP session credentials.)

Another way will be to establish a connection to this server using a PowerShell remote session.

The run as admin will allow you to connect to this domain using another credential.

Also, the embedded script could automate every job you have to run with Powershell.

The cmd.exe run as/netonly or psexec could also be used in RDM like you usually do.

It will simply open another Powershell session outside of RDM.

The Macros have an option to be executed in the previous active windows, which will be useful in this case.

Let me know exactly how you want to execute and which script needs to be done, and I'll guide you through this process.

Best regards,

Patrick Ouimet

avatar

Hello Patrick,

Thanks for the reply! Understood on the MMC tools - we do have the necessary WinRM configuration and firewall rules in place to allow those (and to allow remote PowerShell commands as well) so those aspects should not be an issue. The issues I ran into were all revolving around my user that I run RDM as not having permissions.

An example of the first roadblock I hit was just using the built-in "restart computer" - hoping I could just select a handful of sessions, right-click -> macro/scripts/tools -> reboot computer and reboot them all like that. But it failed because my user that I run RDM under in Windows does not have rights on those remote machines (because as mentioned I connect w/ alternate credentials, using a privileged account).

So that was what started my quest to find a solution to be able to execute a script or command against a session/entry with alternate credentials (ideally, with the same credentials used to connect to the session). Of course, once I find a solution to that I'd love to use it for much more than just rebooting machines, but for a starting point I can use the "reboot" workflow to test until I get a working process.

As for opening remote sessions - I can do that, and then of course just run the commands manually through those sessions to reboot a machine. But I was hoping to get to a point where I could right-click one or more selected entries, and use one of these predefined scripts/macros to easily execute it against those machines (as opposed to having to manually construct the machine list which I have to do when executing commands manually through PowerShell).

Best regards

David Willis

avatar

Hello David,

Thank you for your feedback.

I believe it would be beneficial to have a session together to explore this subject in more depth. Once we discover the best way for you to use RDM with remote tools and sessions, I will share the results of our discussion with the community.

Best regards,

Patrick Ouimet

avatar

Very interested in the direction this takes.

Having the same journey with defining best practice for the sharing in my organization.

avatar

Hello VTScott,

 

Given the recent cases we've encountered, we have decided to write an article on the topic.

 

The article will cover how to use PowerShell remote sessions with a privileged account, specifically running it as an administrator. Please note that WinRM must be configured with the listener set to HTTPS on port 5986. Additionally, the thumbprint used for this configuration cannot be a wildcard or a self-signed certificate.

 

I will share the documentation here once it becomes available in our knowledge base.

 

Best regards,

Patrick Ouimet

avatar

Hello,

This is the article i was talking about:

https://docs.devolutions.net/pam/kb/general-knowledge/management-tools-elevated-privileged-account/

Feel free to reach us if ever you have questions about this topic.

Best regards,

Patrick Ouimet