At scale, using remote powershell with implicit sessions (-computername) in an environment using remote profiles can cause issues on the target servers... safer method is to use explicit sessions in an invoke-command -session with a noprofile flag (get-wmiobject doesn't allow a -session parameter):
function Get-LMCreds_WMI {
param (
$wmi_user = '##WMI.USER##',
$wmi_pass = '##WMI.PASS##'
)
if ([string]::IsNullOrWhiteSpace($wmi_user) -or ( $wmi_user -like '*WMI.USER*')) {
write-output $null
} else {
$remote_pass = ConvertTo-SecureString `
-String $wmi_pass `
-AsPlainText `
-Force
$remote_credential = New-Object `
-typename System.Management.Automation.PSCredential `
-argumentlist $wmi_user, $remote_pass
write-output $remote_credential
}
}
function Get-Session {
$creds = Get-LMCreds_WMI
$option = New-PSSessionOption -NoMachineProfile
if ($creds) {
$session = new-pssession `
-computername $computerName `
-credential $creds `
-SessionOption $option
} else {
$session = new-pssession `
-computername $computerName `
-SessionOption $option
}
write-output $session
}
try {
$serverName = hostname
$computerName = "##system.sysname##.##system.domain##"
$payload = {
quser ### Example query to be made ###
}
if ($serverName -match "##system.sysname##") {
#This is a Collector
$outputString = invoke-command `
-scriptblock $payload
} else {
# Not the Collector
$session = Get-Session
$outputString = invoke-command `
-session $session `
-scriptblock $payload
}
} catch {
write-error $error[0]
write-output -1
}
if ($session) { remove-pssession $session }
It's far more clunky, but in our environments, LM was causing our client users the ability to log in using anything other than a temporary profile most of the time. This fixed it. (WMI in the DataSource itself still does it with implicit sessions, so we minimize the number of WMI DS we use and replace them with powershell script DS using this method)
