problem when starting a job within a remote CredSSP call

So from machine X i'm connecting to Y with Creds A as CredSSP, then i'm passing through Cred B, and i want to start a job on machine Y with Cred B.

Though i can RDP into machine Y as X , and successfully create a job locally as Y, when i do this with remoting. i get an error. here is example code to replicate by problem with

$sb1 = {param($cred) $cred ; write-host "started"  ; start-job  -Credential $cred -ScriptBlock {"yo"} | Wait-Job | Receive-Job }
$j = invoke-command -ComputerName $compy -Credential $creda -Authentication CredSSP -ScriptBlock $sb1 -argumentlist $credb

its erroring on the receive-job , after like 30 seconds or something (maybe some timeout) and i don't see any process created in task manager on y (when i put a sleep in the scriptblock with "yo" just to see).

Here is the error that comes back

[localhost] 开发者_开发知识库The background process reported an error with the following message: .
    + CategoryInfo          : OpenError: (:) [Receive-Job], PSRemotingTransportException
    + FullyQualifiedErrorId : PSSessionStateBroken

The extend of the exception is "The background process reported an error with the following message: ." and there is no innerexception.

As far as I understand everything goes well when whe remove the -Credential parameter of the Start-Job in the remote script.

CredSSP is used when we want our remote session to have full access to network resources. that is what is called double-hope scenario.

In you case you build $credb on computer A this variable contains credentials of B, but when you give $credb as a parameter to your remote script it's serialized and I bet that the second computer is not able to use the encrypted par of the credential.

Itry to recreate credential on the server computer but it fails too.

To use credssp switch, the remote computer needs to be configured to allow it. However, even if that's enable, you cant simply pass a credentials object to remote computer. You can easily test it with below code:

$a="hello world"
Will work: Invoke-Command -ScriptBlock {write-host "hello world"} -session $(get-pssession 2)
Will break: Invoke-Command -ScriptBlock {write-host $a} -session $(get-pssession 2)

What you can do is create a secure string using ConvertFrom-SecureString and pass it as a variable.