CmdID / PowerShell / Cmdlets / Enable
Enable-WSManCredSSP
Enables Credential Security Support Provider (CredSSP) authentication on a computer. PowerShell reference
From the PowerShell reference 3 parameters
What it does
Enables Credential Security Support Provider (CredSSP) authentication on a computer. The Enable-WSManCredSSP cmdlet enables CredSSP authentication on a client or on a server computer. When CredSSP authentication is used, the user credentials are passed to a remote computer to be authenticated. This type of authentication is designed for commands that create a remote session from another remote session. For example, if you want to run a background job on a remote computer, use this kind of authentication. Enable-WSManCredSSP can enable CredSSP on a Client or a Server. To enable CredSSP on a client, specify Client in the Role parameter. Clients delegate explicit credentials to a server when server authentication is achieved. To enable CredSSP on a server, specify Server in the Role parameter. A server acts as a delegate for clients. For more details, see Role in the Parameters section. CAUTION: CredSSP authentication delegates the user credentials from the local computer to a remote computer. This practice increases the security risk of the remote operation. If the remote computer is compromised, when credentials are passed to it, the credentials can be used to control the network session.
Enable-WSManCredSSP [[-DelegateComputer] <String[]>] [-Force] [-Role] <String> [<CommonParameters>]Delegate client credentials
Enable-WSManCredSSP -Role "Client" -DelegateComputer "Server02.fabrikam.com"IdentifyDelegate client credentials to all computers in a domain
Enable-WSManCredSSP -Role "Client" -DelegateComputer "*.fabrikam.com"IdentifyDelegate client credentials to multiple computers
$servers = "server02.fabrikam.com", "server03.fabrikam.com", "server04.fabrikam.com"
Enable-WSManCredSSP -Role "Client" -DelegateComputer $serversIdentifyAllow a computer to act as a delegate
Enable-WSManCredSSP -Role "Server"IdentifyAllow a computer to act as a delegate by using Set-Item
Connect-WSMan -ComputerName "server02"
Set-Item -Path "WSMan:\server02\service\auth\credSSP" -Value $trueIdentifyIts page in the reference: Enable-WSManCredSSP.
Parameters
-DelegateComputerSpecifies servers to which client credentials are delegated. The best practice is to use fully qualified domain names.
Wildcards are accepted, but can enable CredSSP on more computers than necessary.
If the Role parameter is Client, you must specify this parameter. If Role is Server, don't specify this parameter.-ForceForces the command to run without asking for user confirmation.-RoleSpecifies whether to enable CredSSP as a client or as a server. The acceptable values for this parameter are: Client and Server.
If you specify Client, the following actions are performed. These settings allow the client to delegate explicit credentials to a server when server authentication is achieved.
- Enables CredSSP on the client.
- Sets the WS-Management setting <localhost|computername>\Client\Auth\CredSSP to true.
- Sets the Windows CredSSP policy AllowFreshCredentials to WSMan/Delegate on the client.
If you specify Server, the following actions are performed. This policy setting allows the server to act as a delegate for clients.
- Enables CredSSP on the server.
- Sets the WS-Management setting <localhost|computername>\Service\Auth\CredSSP to true.