title: Remote Powershell session connection failure with Kerberos authentication
body: <p>I have an on-premises network and an Azure virtual network that are connected together via a gateway.</p>
  
  <p><a href="https://i.stack.imgur.com/VtPAp.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VtPAp.png" alt="infrastructure_diagram"></a></p>
  
  <p>With this setup, all machines (on-premises and Azure) are joined to the domain which allows me remote access to the administrative shares as well as remote Powershell sessions on each machine in the Azure virtual network from machines in my office.  For example, I can simply open up Windows Explorer and type in the address bar <code>\\machinename\c$</code> or I can open a remote Powershell session by using the command <code>$Session = New-PSSession -ComputerName machinename</code>.</p>
  
  <p>This works perfectly for one of my Azure subscriptions, but on another Azure subscription that appears to be configured identically, the remote Powershell command is failing with error:</p>
  
  <blockquote>
    <p>New-PSSession : [machinename] Connecting to remote server machinename failed with the following error message : WinRM cannot process the request. The following error occurred while 
    using Kerberos authentication: Cannot find the computer machinename. Verify that the computer exists on the network and that the name provided is spelled correctly. For more information, 
    see the about_Remote_Troubleshooting Help topic.</p>
  </blockquote>
  
  <p>When I look in DNS on the Azure domain controller, the machine that I am trying to connect to exists.  When I look in DNS on-premises, the machine is missing.  What it looks like to me is a replication problem between the two domain controllers.</p>
  
  <p>The first thing that is likely to be suggested is to start looking at WinRM configurations on the client machine.  To be clear, the same machine is able to connect successfully to machines in a virtual network in a different Azure subscription so it is very unlikely that anything on the client machine needs to be changed.  Nevertheless, I Googled the Kerberos error with remote Powershell and have checked that the <code>TrustedHosts</code> setting on the client is set to <code>*</code>.</p>
  
  <p>Interestingly enough, I can successfully open a remote Powershell session from a machine in the Azure subscription to a machine in my office, I just can't go the other direction....from Azure to my office.  This would seem to indicate maybe a one-way trust instead of two-way, but I am not sure how to verify this.</p>
  
  <p>I ran <a href="https://www.microsoft.com/en-us/download/details.aspx?id=30005" rel="nofollow noreferrer">the tool</a> and it is reporting that everything is working with regard to replication.</p>
  
  <p>So I guess what I am wondering is if this is truly a replication issue or if someone can give me an idea of what the problem might really be.</p>
  
  <p><strong>Edit 1</strong></p>
  
  <p>Now it looks like the domain controller in the Azure network is replicating just fine but any other VM that I add to the Azure network is not replicating.  Based on this I will guess that the replication is working, but it would seem it only works for the domain controller and not any other machine.  I have no idea what that means.</p>