Author Posts

September 10, 2015 at 10:52 am

I'm completely lost why my admin account can not use Import-Module in WinRM session
Example is below. Also following event is being logged to PowerShell eventlog


PS C:\Windows\system32> import-module Webadministration
PS C:\Windows\system32> invoke-command localhost {Write-Output "success"; Import-module Webadministration}
success
Access is denied
+ CategoryInfo : NotSpecified: (:) [Import-Module], UnauthorizedAccessException
+ FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.ImportModuleCommand
+ PSComputerName : localhost

PS C:\Windows\system32>

Error Message = Access is denied
Fully Qualified Error ID = System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.ImportModuleCommand

Context:
Severity = Warning
Host Name = ServerRemoteHost
Host Version = 1.0.0.0
Host ID = 7500affe-fdfc-4509-b2ea-6d7536b468fc
Host Application = C:\Windows\system32\wsmprovhost.exe -Embedding
Engine Version = 4.0
Runspace ID = 9692a1c4-b8a4-4560-9c3e-7903dad52b91
Pipeline ID = 2
Command Name = Import-Module
Command Type = Cmdlet
Script Name =
Command Path =
Sequence Number = 19
User = PROD\admin
Shell ID = Microsoft.PowerShell

User Data:

September 10, 2015 at 10:56 am

Probably a second-hop issue. If I remember correctly, the WebAdministration module immediately does some remote stuff (over COM or something) when you import it.

September 10, 2015 at 11:26 am

I hope this is not true since it essentially means that PowerShell can not be used for administering IIS remotely out of the box

September 10, 2015 at 11:30 am

I found the reason. $env:PSModulePath includes network location. So when I use Import-Module it tries to find if Module available from network and get access denied and stop looking after that instead of continuing with the rest of ModulePath. I don' t know if this is a bug or inteded consequence.