I’m trying to copy some files from a domain-joined computer, to a non-domain-joined server (it is not on a domain at all). Using PowerShell 5.1.
I want to do this with a script run from a scheduled task, so prompting for the password won’t work. To deal with this I have created a PSCredential object with the Username and Password fields populated. For the username I am using ‘servername\username’ as it is an account local to the remote system. The password is being retrieved dynamically from a PIM solution and is already in PSCredential format. The credential object is created using:
New-Object System.Management.Automation.PSCredential -ArgumentList (“servername\username”, <System.Security.SecureString value>).
I am trying to do this as simply as possible. I looked at just using Copy-Item, as well as New-PSSession and New-PSDrive. I landed on using:
New-PSDrive -Name “DriveName” -PSProvider Filesystem -Root “\\server\path” -Credential <PSCredential object>
Once that completes, I can use Copy-Item to copy files to the remote system without having to authenticate again. (Note that I don't directly reference the PSDrive here, it was just a way for me to create a transient, authenticated session to the remote computer.)
Copy-Item -Path <local source path> -Destination "\\server\path" -Recurse -Force
All of this actually does work – however the issue is that before logging in using the user/pass stored in the PSCredential object, the system first tries an NTLM login using my local domain account (the one running the script). After that tries about 3x and fails (the remote server has no way of validating my domain account), only then does it use the creds in the object.
Not necessarily the end of the world, but it does waste some time, and on top of that it also fires all kinds of alerting within our SOC team as it generates a bunch of failed logins to the off-domain computer, all coming from my domain account.
Is there a way to avoid that initial NTLM auth attempt with the domain account, and just jump straight into using the ‘servername\username’ account that is local to the remote system? Or, am I doing this completely wrong and there’s a better way? :)
Thanks!
(P.S. Also posted here: https://forums.powershell.org/t/copy-item-to-non-domain-computer/16721/4)