Enter-PSSession cmdlet fails when network path specified in PSModulePath environment variable

Applies to: Windows Server 2008 R2Windows Server 2012 R2Windows Server 2016

Symptom


When a network path is specified in the PSModulePath environment variable, the Enter-PSSession cmdlet fails, and you receive the following error message:

Cause


When a PS session is created and authenticates through Kerberos, the session doesn't support double hop. Therefore, the PS session can't authenticate by using network resources.

When PowerShell tries to enumerate the modules in the network path, the operation fails with "Access Denied," and the command unexpectedly terminates

Resolution


To fix the issue, create the PS session to authenticate with CredSSP. This needs to be configured in advance. On the computer that is the target of the Enter-PSSession command, run this command:

Enable-WSManCredSSP -Role Server

On the computer on which you run the Enter-PSSession command, run this command:

Enable-WSManCredSSP -Role Client -DelegateComputer Servername

Every time that this command is executed, the specified Servername is added to the list. The list is stored in the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentials

To view the status of the CredSSP configuration, run the Get-WSManCredSSP command.

After CredSSP is enabled, you can authenticate through CredSSP by using this command:

Enter-PSSession servername -Authentication CredSSP -Credential (Get-Credential username)

Workaround


To work around this issue, map the network share to a drive letter such as S:, and then put the drive letter in the PSModulePathHaving a drive letter that points to a network share will not cause the unexpected termination of Enter-PSSession.

However, inside the remote PowerShell session the mapped drive letter will not be available, and the modules on the network share will still not be available. Only the local modules will be available.

This workaround will only prevent the Enter-PSSession from crashing while allowing normal PowerShell sessions to have access to the modules that are on the network share.