We have many servers with a ASP.Net application installed. I'm trying to figure out a automatic way to connect to the sql server using Powershell.
They use a domain account to run the app pool. I have the code below to get the connection string from the app and the app pool identity to try to open a connection to sql.
However, when I run it in powershell, the sql login fails for, Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. I don't understand why. I confirmed the ASP.Net Application is using the App Pool Identity in SQL via sp_who2.
Output confirms that the invoke-command is using the App Pool Identity. I can't change the connectionstring per business policies. I want to only use .Net to connect to SQL because I know .Net framework 4.8 will be on all machines I use to run it.
I removed the code for getting the connection string and app pool identity from the sample below in hopes to allow more people to troubleshoot.
Just update the username, password, and server name below and try it out
$username = 'MyUsername'
$password = 'MyPassword'
$ConnStr = 'Data Source=MyServer;Trusted_Connection=yes;'
$query = 'Select system_user, @@servername DBHostName,(SELECT login_time FROM sys.sysprocesses where spid=1)SQLUptime, @@version SQLVersion;'
$SQLPoshCmds = {
$env:USERNAME
$args[0]
try{
$SqlConnection = New-Object System.Data.SqlClient.SqlConnection
$SqlConnection.ConnectionString = $args[0]
$SqlCmd = New-Object System.Data.SqlClient.SqlCommand
$SqlCmd.CommandText = $args[1]
$SqlCmd.Connection = $SqlConnection
$SqlAdapter = New-Object System.Data.SqlClient.SqlDataAdapter
$SqlAdapter.SelectCommand = $SqlCmd
$SqlConnection.open()
$DataSet = New-Object System.Data.DataSet
$SqlAdapter.Fill($DataSet)
$DataSet.Tables|fl
}
Catch{
$_
# write "`r`n$($_.Exception)"
# write $_.ScriptStackTrace
# write $_.ErrorDetails
}
Finally{
$SqlConnection.Close()
$SqlConnection.Dispose()
}
}
if($ConnStr.Contains('Trusted_Connection=yes;')){
invoke-command -ArgumentList $ConnStr,$query -ComputerName '.' -ScriptBlock $SQLPoshCmds -Credential (New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $username,(ConvertTo-SecureString -AsPlainText $password -Force))
}else{
invoke-command -NoNewScope -ScriptBlock $SQLPoshCmds
}
master.sys.sysprocesses
instead ofsys.sysprocesses
, depending on the default database specified on the connection (or the App Pool Identity user's default database if none is specified in the connection string). Also the user will need theVIEW SERVER STATE
permission to see any sessions other than their own.Invoke-Command
in your own Impersonation Context?ComputerName '.'
which would imply there is no double hop. But are you actually invoking on the local machine, or did you just put in the '.' to avoid any including any internal stuff in your SO question?