title: Access to password protected network share (double/second hop limitation)
body: <p>This is about the famous double-hop limitation that looks trivial and has at least 10 workarounds but I cannot find even one that works for my setup.</p>
  
  <p>Here is my environment: I have ~50 virtual machines on Windows&nbsp;10, every VM runs on a separate hardware - we use virtual machines because our IT guys claim it's easier to maintain and physical ones, I personally dislike VMs but it's not something that depends on me.
  We are on a non-domain environment, no Active Directory, we use a workgroup and every machine is administered individually.</p>
  
  <p>My goal is to optimize PC management like installing software, registering/starting services and etc - I need to do that on all machines at once not to perform each task 50 times. I managed to run PowerShell remote relatively quickly but very soon I stuck on non being able to access any network resource that requires additional authentication (all our network shares requires LDAP authentication).</p>
  
  <p>What I tried so far.</p>
  
  <ol>
  <li><p>Re-authenticate from the session, described <a href="https://powershellexplained.com/2017-04-22-Powershell-installing-remote-software/#re-authenticate-from-the-session" rel="nofollow noreferrer">here</a>:</p>
  
  <pre><code>$mappedDrive = @{
      Name = "u"
      PSProvider = "FileSystem"
      Root = "\\bladefs\share2"
      Credential = 'svetlozar.draganov'
  }
  Invoke-Command -ComputerName bw33 -ScriptBlock {
      New-PSDrive @using:mappedDrive
      Get-Content -Path \\bladefs\share2\text.txt
      Get-PSDrive
      Remove-PSDrive -Name "u"
      Get-PSDrive
  } -Credential render
  </code></pre>
  
  <p>What the above command does is to run a remote command via <code>Invoke-Command</code> that request two authentications, the first authentication is to connect to the machine bw33 then with a <code>New-PSDrive</code> command another authentication is sent to an already establishes session with bw33 to mount a network share with username and password. This sometimes on very rare occasions actually works, but I cannot pinpoint when and why it works and why in most of the cases doesn't work. Even though I'm executing absolutely the same PowerShell script a dozen of times it only works for a very small percentage of them the rest of them it just says this:</p>
  
  <pre class="lang-none prettyprint-override"><code>A specified logon session does not exist. It may already have been
  terminated
      + CategoryInfo          : InvalidOperation: (u:PSDriveInfo) [New-PSDrive], Win32Exception
      + FullyQualifiedErrorId : CouldNotMapNetworkDrive,Microsoft.PowerShell.Commands.NewPSDriveCommand
      + PSComputerName        : bw33
  Cannot find path '\\bladefs\share2\text.txt' because it does not exist.
      + CategoryInfo          : ObjectNotFound: (\\bladefs\share2\text.txt:String) [Get-Content], ItemNotFoundException
      + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand
      + PSComputerName        : bw33
  </code></pre>
  
  <p>I actually captured a working and non-working attempt on the video bellow:
  <a href="https://drive.google.com/uc?id=1HYD8p-VkLYyIExZVWO_8qgpI2kmlUDgF" rel="nofollow noreferrer">https://drive.google.com/uc?id=1HYD8p-VkLYyIExZVWO_8qgpI2kmlUDgF</a></p>
  
  <p>As you can see with first execution everything is fine PSDrive is mapped successfully and I can reach \bladefs\share2 network path but with second execution I got some errors.</p></li>
  <li><p>Similar as the above but instead of mapping drive via PSDrive command mapping it via NET USE command with username and password.</p>
  
  <pre><code>Invoke-Command -ComputerName bw33 -Credential render -ScriptBlock {
      net use x: \\bladefs\share2 /user:svetlozar.draganov password
      Test-Path \\bladefs\share2
  }
  </code></pre>
  
  <p>This, as the first, sometimes works but again it only works once, all subsequent execution leads to this error:</p>
  
  <pre class="lang-none prettyprint-override"><code>System error 1312 has occurred.
      + CategoryInfo          : NotSpecified: (System error 1312 has occurred.:String) [], RemoteException
      + FullyQualifiedErrorId : NativeCommandError
      + PSComputerName        : bw33
  A specified logon session does not exist. It may already have been terminated.
  </code></pre>
  
  <p>Here is a video of another attempt that again captures working and non-working execution of that command:
  <a href="https://drive.google.com/uc?id=1wP20sbmXMfWu4dvjsdF8REDWgNxiKAS-" rel="nofollow noreferrer">https://drive.google.com/uc?id=1wP20sbmXMfWu4dvjsdF8REDWgNxiKAS-</a></p></li>
  <li><p>Using CredSSP described <a href="https://blogs.technet.microsoft.com/heyscriptingguy/2012/11/14/enable-powershell-second-hop-functionality-with-credssp/" rel="nofollow noreferrer">here</a>:</p>
  
  <pre><code>$session = New-PSSession -cn bw33 -Credential render -Authentication Credssp
  Invoke-Command -Session $session -ScriptBlock {Test-Path \\bladefs\share2}
  </code></pre>
  
  <p>Although this is the most popular and insecure way to resolve this issue I decided to give it a try cause recommended options didn't work. Unfortunately I hit a brick with this approach as well, here are the errors:</p>
  
  <pre class="lang-none prettyprint-override"><code>New-PSSession : [bw33] Connecting to remote server bw33 failed with
  the following error message : The request is not  supported. For more
  information, see the about_Remote_Troubleshooting Help topic.
  At line:1 char:12
  + $session = New-PSSession -cn bw33 -Credential render -Authentication  ...
  +            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTransportException
     + FullyQualifiedErrorId : 50,PSSessionOpenFailed
  Invoke-Command : Cannot validate argument on parameter 'Session'. The
  argument is null or empty. Provide an argument that is  not null or empty,
  and then try the command again.
  At line:2 char:25
  + Invoke-Command -Session $session -ScriptBlock {Test-Path \\bladefs\sh ...
  +                         ~~~~~~~~
     + CategoryInfo          : InvalidData: (:) [Invoke-Command], ParameterBindingValidationException
     + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.InvokeCommandCommand
  </code></pre>
  
  <p>And respectively the video:
  <a href="https://drive.google.com/uc?id=10tbAq6vvRsvT-1SGqOzvPgIPcM-MT8CJ" rel="nofollow noreferrer">https://drive.google.com/uc?id=10tbAq6vvRsvT-1SGqOzvPgIPcM-MT8CJ</a></p></li>
  </ol>