Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

SAM PowerShell monitors not working on new Polling engine

I built a new polling engine and PowerShell script monitors are not working from the new polling engine. Debug log just says access denied. The credentials are the same on the working/non-working systems. I set trusted hosts for WinRM to * for all systems trusted. I don't think it is a SolarWinds issue per se because I can do a new-pssession from the old engines but not the new ones. Test-WSMan works from both new and old, so not the firewall. I didn't see anything in the get-help for About_Remote_Troubleshooting that seemed to apply. I also installed .net 3.5 and PowerShell engine 2 because it says that is required but didn't seem to help. Honestly hope that isn't required. Any help is greatly appreciated.

Find more posts tagged with

Accepted answers

joshfoxbuckeye

Solved : The problem ended up being the VMware image we were using. It was provided by our Security team and must have had some hardening performed. We were never able to identify the exact issue, but using an image from a clean 2019 server install worked fine and resolved this issue.

joshfoxbuckeye

Also, legacy .NET and PowerShell were not required.

All comments

weston.hood

Did you set TrustedHosts on the polling engine or the remote server or both? It sounded like you only set on the polling engine. You will need to go to the monitored server and have it trust the polling engine(s) as well. The trust needs to be set on both sides.

joshfoxbuckeye

So here is the weird thing about that. There are no trusted hosts configured on the target system. output is below

   WSManConfig: Microsoft.WSMan.Management\WSMan::localhost\Client

Type            Name                           SourceOfValue   Value
----            ----                           -------------   -----
System.String   TrustedHosts

Now after doing the same thing and setting trusted hosts to * still does't work. I restarted WinRM service just to be safe as well. Since there was no setting configured here and it worked with the other polling engine, I don't think this is the problem. Changing it didn't seem to help.

weston.hood

i believe you also said you cannot PSsession from polling engine to target server- right?

Are you using this cmdlet?
Enter-PSSession -ComputerName <IP/Hostname> -Credential <domain\username>

Does the pssession fail with a error or some message? What happens exactly when you attempt to open the connection?

joshfoxbuckeye

This is the error that appears in the logs on the target system only when I try new-pssession or invoke-command from the new polling engine. We have a one way trust with the administration domain from each customer domain. The old servers are 2016 and the new ones are 2019 server.

Log Name:      System
Source:        LsaSrv
Date:          5/13/2024 8:57:40 AM
Event ID:      40970
Task Category: None
Level:         Warning
Keywords:
User:          SYSTEM
Computer:      target computer
Description:
The Security System has detected a downgrade attempt when contacting the 3-part SPN

LDAP/mydc.domain.com/domain.com@domain.com

with error code "The SAM database on the Windows Server does not have a computer account for this workstation trust relationship.
(0xc000018b)". Authentication was denied.

I might try removing from and adding back to the domain. Not sure what to try after that. The search results for this error are fairly complicate so not sure which may apply yet.

joshfoxbuckeye

Also, legacy .NET and PowerShell were not required.