Why Does WinRM Break Your PowerShell Session and How Do You Fix It?

#You're Connected via WinRM. Why Can't You Query the Domain Controller?#link

You evil-winrm into DEV01 as backupadm. You import PowerView. You run Get-DomainUser -SPN. And you get: "An operations error occurred." What happened? Your credentials are valid. You're authenticated. The DC is reachable. But Kerberos won't let you talk to it from this remote session.

This is the Kerberos Double Hop problem. When you authenticate via WinRM, your TGS ticket grants access to that specific host. Your TGT (the master ticket that can request new TGS tickets) is NOT sent to the remote machine. So when PowerView tries to query LDAP on the DC, there's no TGT available to request a new service ticket. Authentication fails.

Why doesn't this happen with RDP or psexec?

Because RDP and psexec use NTLM or pass the actual password/hash. When you RDP to a host, your password is used to authenticate, and the resulting NTLM hash is cached in the session's LSASS memory. Any subsequent authentication to other hosts can use that cached hash. WinRM with Kerberos never caches the password. It uses a ticket scoped to one service. One hop. No more.

One ticket. For the HTTP service on DEV01. That's all you get. No krbtgt ticket. No LDAP ticket for the DC. You're sandboxed to this one host.

Workaround 1: PSCredential object with every command

By passing -Credential with every command, PowerView uses those explicit credentials to authenticate directly to the DC rather than relying on the session's Kerberos context. It works. But it's tedious. Every single command needs the -Credential flag. And some tools don't support it.

Workaround 2: Register-PSSessionConfiguration (GUI access required)

You'll hit this problem on every engagement where you use WinRM for lateral movement. Know the workarounds. Use the PSCredential method from evil-winrm. Use Register-PSSessionConfiguration when you have RDP access to a Windows jump host. And if unconstrained delegation is enabled on the target, the problem doesn't exist at all. But that's a different module.