Search code examples
azurepowershellazure-active-directorywmiget-wmiobject

Remote WMI query failing with 'A security package specific error occurred' when using Azure Active Directory user

I'm attempting to query a remote machine with the PowerShell cmdlet: Get-WmiObject and using credentials for a user in Azure AD that has the Azure AD joined device local administrator role and the IAM role assignment of Virtual Machine Administrator Login on the remote machine.

When I run the following command:

Get-WmiObject -Class Win32_Process -Namespace "root/cimv2" -ComputerName <remote_computer_local_ip> -Impersonation Impersonate -Credential AzureAD\<username>

I receive the following error message:

Get-WmiObject : A security package specific error occurred. (Exception from HRESULT: 0x80070721)

Is the ability to run remote WMI queries supported when using an Azure AD user?

Remote machine specs:

  • Windows Server 2019 Datacenter
  • 10.0.17763 Build 17763

Other troubleshooting notes:

  • I'm able to sign to the remote machine with the same user and have followed the steps in the https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows document
  • When running the same command on the remote machine locally it properly returns the Win32_Process data
  • If I use the local administrator credentials on the remote command it also works which suggests that remote WMI is working
  • Both computers are Azure AD joined and show AzureAdJoined : YES from the dsregcmd /status command
  • I've attempted to use the Computer Name, Local IP, and FQDN and they all yield the same result
Solution

  • After talking with Microsoft support about this issue, it seems that the error stems from the different authentication methods between a local user account and an Azure AD account.

    It seems it is not supported as they are using different authentication protocols. Azure AD user uses OAuth and the security error is due to Kerberos.

    Here is the reference article for more details: Authentication protocols in Azure Active Directory B2C | Microsoft Docs

    They have also mentioned that there is no current information on whether or not this will be supported in the future and have recommend checking Azure updates for future product updates.