# Problem with INVOKE-COMMAND in AD Forest **URL:** \ **Category:** PowerShell Help\ **Created:** [September 3, 2024, 2:02pm UTC](https://forums.powershell.org/t/problem-with-invoke-command-in-ad-forest/24681 "2024-09-03T14:02:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![BPelletier](https://avatars.discourse-cdn.com/v4/letter/b/b3f665/32.png) [@BPelletier](https://forums.powershell.org/u/BPelletier)\ **Post date:** [September 3, 2024, 2:02pm UTC](https://forums.powershell.org/t/problem-with-invoke-command-in-ad-forest/24681/1 "2024-09-03T14:02:37Z")
Hi everyone and thanks for the help, I’m trying from my computer to make a script that will cover all step of user creation. One of this steps is to add a user from my domain to a “local domain group” of another domain. Here is what we came up with that doesn’t work : ```auto Invoke-Command -Session $session -ScriptBlock { param($groupName, $user, $SecondaryServer) $user1 = Get-ADUser -Filter "SamAccountName -eq '$user'" -Server $SecondaryServer Add-ADGroupMember -Identity $groupName -Members $user Write-Host "User '$user' successfully added to group '$groupName'" } -ArgumentList $selectedGroup.Name, $user, $SecondaryServer ``` But when connect on DC.AD2.LAN , this works : ```auto $SecondaryServer = "DC.AD1.local" $userName = "user.exemple.1" $user = Get-ADUser -Filter "SamAccountName -eq '$userName'" -Server $secondaryServer Add-ADGroupMember -Identity "group.exemple.1" -Members $user -ErrorAction Stop ``` I get an error in get-aduser where it says the server can’t be reached. Here a few facts : - a ping of DC.AD1.local inside the invoke-command will work - ADWS is running i’m going to draw something that, i hope, will help. also, I’ll edit for readability. thanks ![Schema](https://us1.discourse-cdn.com/flex019/uploads/powershell/original/2X/5/547f2cada5b31f4488cc69227705ffc0257217e1.png) ---
**Author:** ![grey0ut](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/grey0ut/32/5310_2.png) [@grey0ut](https://forums.powershell.org/u/grey0ut)\ **Post date:** [September 3, 2024, 2:45pm UTC](https://forums.powershell.org/t/problem-with-invoke-command-in-ad-forest/24681/2 "2024-09-03T14:45:28Z")
if you’re doing Invoke-Command against DC.AD2.LAN and then in your script block you’re using cmdlets that require authentication against remote hostDC.AD1.local, then you’re probably running in to the Kerberos double-hop. Also, I don’t see that you **are** providing alternate credentials in your scriptblock when doing work against the other domain. Even if you were I think it would fail because of the kerberos double-hop, but, since you aren’t it means all of the cmdlets in your script block are running as whatever account you used to created `$session` with. ---
**Author:** ![BPelletier](https://avatars.discourse-cdn.com/v4/letter/b/b3f665/32.png) [@BPelletier](https://forums.powershell.org/u/BPelletier)\ **Post date:** [September 3, 2024, 3:01pm UTC](https://forums.powershell.org/t/problem-with-invoke-command-in-ad-forest/24681/3 "2024-09-03T15:01:47Z")
“then you’re probably running in to the Kerberos double-hop.” Is that a famous thing that’s not possible ? I’m connecting as admin.ad2.lan so i should be able to just add a user from the other domain. The following works when used in another script ran on DC.AD2.LAN) : ```auto $user = Get-ADUser -Filter "SamAccountName -eq '$samAccountName'" -Server $secondaryDC -ErrorAction Stop Add-ADGroupMember -Identity $groupName -Members $user -ErrorAction Stop ``` So in this instance, it doesn’t feel like it’s a credential issue. But i’m no expert 😃 ---
**Author:** ![grey0ut](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/grey0ut/32/5310_2.png) [@grey0ut](https://forums.powershell.org/u/grey0ut)\ **Post date:** [September 3, 2024, 3:12pm UTC](https://forums.powershell.org/t/problem-with-invoke-command-in-ad-forest/24681/4 "2024-09-03T15:12:32Z")
yeah if you google it you’ll find dozens of articles on it: [https://www.techtarget.com/searchwindowsserver/tutorial/How-to-avoid-the-double-hop-problem-with-PowerShell](https://www.techtarget.com/searchwindowsserver/tutorial/How-to-avoid-the-double-hop-problem-with-PowerShell) I’m not sure I’m understanding your AD setup or why an Admin account in AD2.lan would inherently have rights in AD1.local but I don’t think that matters because this is definitely the kerberos double hop. Lots of people have this issue that have to use jump boxes to complete tasks on servers. ---
**Author:** ![BPelletier](https://avatars.discourse-cdn.com/v4/letter/b/b3f665/32.png) [@BPelletier](https://forums.powershell.org/u/BPelletier)\ **Post date:** [September 3, 2024, 3:27pm UTC](https://forums.powershell.org/t/problem-with-invoke-command-in-ad-forest/24681/5 "2024-09-03T15:27:23Z")
Well, those two domains trust each other and i can (with GUI or CLI) list and fetch user from the other domain without having to change credential. like in the previous exemple, i’m adding a user from AD1 in a group of AD2. this is the error i get when i do the invoke-command : ```auto Get-ADUser : Impossible de contacter le serveur. Il se peut que le serveur n’existe pas, est actuellement hors service ou ne dispose pas des services Web Active Directory. Au caractère Ligne:1 : 9 + $user = Get-ADUser -Filter "SamAccountName -eq '$userName'" -Server $ ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ResourceUnavailable: (:) [Get-ADUser], ADServerDownException + FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.GetADUser ``` The French error message: “Impossible de contacter le serveur. Il se peut que le serveur n’existe pas, est actuellement hors service ou ne dispose pas des services Web Active Directory.” Translates to English as: “Unable to contact the server. The server may not exist, is currently unavailable, or does not have Active Directory Web Services.” and by the way, thanks for the answers ! I’ll try the double hop thingy stuff ---
**Author:** ![krzydoug](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/krzydoug/32/1008_2.png) [@krzydoug](https://forums.powershell.org/u/krzydoug)\ **Post date:** [September 3, 2024, 7:40pm UTC](https://forums.powershell.org/t/problem-with-invoke-command-in-ad-forest/24681/6 "2024-09-03T19:40:08Z")
It’s not a permission issue. The double hop means the credentials (the user you are running as) can’t be used to make another hop without configuring delegation. You could also use a different set of credentials to execute the second hop as to it, it is the first hop. You can easily confirm the double hop issue by RDP to the same system and run the scriptblock there and if it succeeds, that confirms double hop. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/powershell/original/1X/385e4f9fe133561ad30a814262fe0e0ae6bc3ef0.png) [@system](https://forums.powershell.org/u/system)\ **Post date:** [October 3, 2024, 7:40pm UTC](https://forums.powershell.org/t/problem-with-invoke-command-in-ad-forest/24681/7 "2024-10-03T19:40:15Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.