Search code examples
phppowershelliis

Remote Powershell exec from PHP (Exchange on-prem) : Access Denied

I have a powershell script creating user mailbox called by PHP running in a IIS 10 server.

The thing is, when I run this script from the Webserver in powershell it works but when I run it from PHP, I get Access Denied

Connecting to remote server server.domain.local failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic. At C:\Scripts\AD_CreateMailbox.ps1:46 char:34 + ... sessionEX = New-PSSession -sessionOption $sessionOption -Configuratio ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotin gTransportException + FullyQualifiedErrorId : AccessDenied,PSSessionOpenFailed

Things I did :

  • Enable Remote Powershell on exchange server
  • Allow the Webserver in the Trustedhosts of the Exchange's WinRM
  • Run the Webserver with a restricted domain User with the appropriate rights to create a Mailbox
  • Allow Kerberos auth on Exchange's server

I'm guessing maybe I have to use IIS impersonation but not really sure and I did not really find anything well detailed on how to configure this.

Do you have some tips on this or anybody have ever make this work perhaps ?

Thanks :)

Solution

  • Figured out after monitoring on both sides (Webserver and Exchange) after reading this post : https://codermike.blogspot.com/2016/06/new-pssession-access-denied.html

    Turned out the issue came from the webserver and the IIS right to write in the registry.

    The key which the IUSR needs to have write access on : HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WSMAN\Client\ConnectionCookies

    Turn out this key was missing on my webserver so I created it and allowed the IUSR to write in it.