Enabling CredSSP authentication

Enabling CredSSP authentication

Why is CredSSP needed?

CredSSP delegates the users' credentials from one computer to another remote computer. Use CredSSP authentication when the Remote Server is present in a different domain other than that of the Applications Manager server domain, or if proper Kerberos delegation is not configured (even within the same domain) causing 'double-hop' issue. This is used for Active Directory, SharePoint Server and Exchange Server monitors to monitor some specific metrics.

How to enable CredSSP authentication?

Perform the following steps on the Remote Server:
  1. Open Windows PowerShell as Administrator and execute the below commands in the Administrator PowerShell: 
    Quote
    Enable-WSManCredSSP -Role Server
  1. Open gpedit.msc and go to Local Computer Policy -> Computer Configuration -> Administrative Templates -> System -> Credentials Delegation
                  - Enable Encryption Oracle Remediation and set Protection Level to Mitigated (Optional)

Perform the following steps on the Applications Manager Server:
NotesReplace <HostName> with the hostname of the Remote Server.
  1. Open Windows PowerShell as Administrator and execute the below commands in the Administrator PowerShell: 
    Quote
    Enable-WSManCredSSP -Role client -DelegateComputer <HostName>
  1. Open gpedit.msc and go to Local Computer Policy -> Computer Configuration -> Administrative Templates -> System -> Credentials Delegation.
                  - Enable Allow delegating fresh credentials and set value "wsman/<HostName>"
                  - Enable Allow delegating fresh credentials with NTLM-only server authentication and set value "wsman/<HostName>"

Follow the below steps in Applications Manager installed server to verify:
  1. In the Administrator PowerShell, execute the below command:
Quote
$testSession= New-PSSession -ComputerName <HostName> -Authentication Credssp -Credential Get-Credential
  1. If Session is created without any error, enable the Use CredSSP authentication option in the Edit Monitor page and update the monitor.

Where to use CredSSP?

  1. For Diagnostic Tests in Active Directory monitor when the AD server is a non-primary domain controller present, if the Applications Manager installed server is in a different domain than the AD server, or if proper Kerberos delegation is not configured (even within the same domain) causing 'double-hop' issue.
  2. For SharePoint Server monitoring in PowerShell mode, when the SharePoint Server is present in a domain other than that of the Applications Manager domain, or if proper Kerberos delegation is not configured (even within the same domain) causing 'double-hop' issue.
  3. For Queues in non-Mailbox role Exchange Server monitors added in PowerShell mode.