# Double hop permissions?

**URL:** <https://forums.powershell.org/t/double-hop-permissions/2290>\
**Category:** PowerShell Help\
**Created:** [February 25, 2014, 5:07am UTC](https://forums.powershell.org/t/double-hop-permissions/2290 "2014-02-25T05:07:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rene-nielsen](https://avatars.discourse-cdn.com/v4/letter/r/bbe5ce/32.png) [@rene-nielsen](https://forums.powershell.org/u/rene-nielsen)\
**Post date:** [February 25, 2014, 5:07am UTC](https://forums.powershell.org/t/double-hop-permissions/2290/1 "2014-02-25T05:07:21Z")

</div>

I am troubleshooting what I think is a Kerberos double-hop permissions issue. Here’s the setup:

Server1 = Windows Server 2008 R2  
Client1 = Windows 7

The account context in use is the same account on both systems and this account is in the local Administrators group.

On Server1 I have created a symbolic link to a folder on Client1 as follows:  
MKLink /D c:\workspace \Client1\c$\workspace

On Client1 I attempt a remote access to Server1 and, via the symbolic link back to the target folder as follows:  
enter-pssession Server1  
set-location c:\workspace  
get-Childitem  
This last command returns:  
“Access to the path c:\workspace is denied.  
PermissionDenied”

Note that there is no issue executing Get-ChildItem on the target remotely linked folder while logged directly onto Server1.

I have attempted to resolve the issue with _Enable-WSManCredSSP_ on Client1 as the “Client” Role and on Server1 as the “Server” Role but to no avail.

I have not as yet requested that the Active Directory record for Server1 be granted rights to delegate. Will try that next but if anyone has any suggestions other than that please let me know.

TIA

---

<div class="post-metadata">

**Author:** ![richard-siddaway](https://avatars.discourse-cdn.com/v4/letter/r/d78d45/32.png) [@richard-siddaway](https://forums.powershell.org/u/richard-siddaway)\
**Post date:** [February 25, 2014, 5:11am UTC](https://forums.powershell.org/t/double-hop-permissions/2290/2 "2014-02-25T05:11:52Z")

</div>

Is the account you are using a domain account or a local account?

With credSSP enabled have you tried accessing the folder on server1 directly rather than through the link?  
The other obvioius question to ask is do you really need to go through client1 or can you go direct to server1?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/powershell/original/1X/385e4f9fe133561ad30a814262fe0e0ae6bc3ef0.png) [@system](https://forums.powershell.org/u/system)\
**Post date:** [February 25, 2014, 5:23am UTC](https://forums.powershell.org/t/double-hop-permissions/2290/3 "2014-02-25T05:23:56Z")

</div>

You need to add the “-Authentication Credssp” argument to Enter-PSSession. It’s not enough to just enable that feature on the client and server; you also have to specify that as your connection mechanism for any remoting connections that need to use it.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:52pm UTC](https://forums.powershell.org/t/double-hop-permissions/2290/4 "2024-05-16T20:52:22Z")

</div>