使用IP的PowerShell credSSP会话

Question

我需要使用从服务器A到服务器B的credSSP身份验证打开Powershell远程会话，但是，服务器A不能解析B的名称。在A上启用了CredSSP以将凭据(在“允许委派新凭据”中启用)传递给B，而B被配置为接收委派的凭据。是否有可能以某种方式使用IP地址而不是主机名/FQDN打开credssp？

PS C:\Windows\system32> New-PSSession xxx.xxx.xxx.xxx -Authentication Credssp -Credential user
New-PSSession : [xxx.xxx.xxx.xxx] Connecting to remote server xxx.xxx.xxx.xxx failed with the following error message : The WinRM c
lient cannot process the request. A computer policy does not allow the delegation of the user credentials to the target
 computer because the computer is not trusted. The identity of the target computer can be verified if you configure the
 WSMAN service to use a valid certificate using the following command: winrm set winrm/config/service '@{CertificateThu
mbprint="<thumbprint>"}'  Or you can check the Event Viewer for an event that specifies that the following SPN could no
t be created: WSMAN/<computerFQDN>. If you find this event, you can manually create the SPN using setspn.exe .  If the
SPN exists, but CredSSP cannot use Kerberos to validate the identity of the target computer and you still want to allow
 the delegation of the user credentials to the target computer, use gpedit.msc and look at the following policy: Comput
er Configuration -> Administrative Templates -> System -> Credentials Delegation -> Allow Fresh Credentials with NTLM-o
nly Server Authentication.  Verify that it is enabled and configured with an SPN appropriate for the target computer. F
or example, for a target computer name "myserver.domain.com", the SPN can be one of the following: WSMAN/myserver.domai
n.com or WSMAN/*.domain.com. Try the request again after these changes. For more information, see the about_Remote_Trou
bleshooting Help topic.
At line:1 char:1
+ New-PSSession xxx.xxx.xxx.xxx -Authentication Credssp -Credential user

Answer 1

"credssp“需要在组策略"AllowFreshCredentials”中设置SPN。

“必须在AllowFreshCredentials客户端上启用允许委派新凭据(AllowFreshCredentials)策略设置，并且必须向策略中添加带有WSMAN前缀的服务主体名称(SPN)。”

https://msdn.microsoft.com/en-us/library/ee309365%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396

SPN的语法需要FQDN或NetBIOS名称，而不是IP地址。

https://msdn.microsoft.com/en-us/library/ms677601(v=vs.85).aspx