Question

我实现了一个powershell脚本，该脚本将Exchange设置分配给我们的用户邮箱（Exchange 2016）。由于我们有很多邮箱，并且分配设置很慢，因此该脚本将运行15个小时以上。但是，大约10个小时后，我收到以下错误消息：

Processing data for a remote command failed with the following error message: Error occurred during the Kerberos response. 
[Server=XXXXX, TimeStamp = 74/2018 01:25:49]
For more information, see the about_Remote_Troubleshooting Help topic.
At C:\Users\ACCOUNT\AppData\Local\Temp\tmp_cj3akhk4.osq\tmp_cj3akhk4.osq.psm1:77943 char:9
+         $steppablePipeline.End()
+         ~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : OperationStopped: (XXXX:String) [], PSRemotingTransportException
+ FullyQualifiedErrorId : JobFailure
+ PSComputerName        : XXXX

我的脚本退出该操作，并且在两次重试（失败）后，显示身份验证提示。在这里，我可以输入服务帐户的密码，然后脚本继续。但是，仅当我在PS命令提示符下运行脚本时，此对话框才可见。如果脚本是作为Windows任务启动的，则它会挂起并且不会继续。

使用以下代码打开并导入到Exchange的连接。代码可以根据传递的参数连接到本地Exchange或联机Exchange。当前，仅当连接到我们本地（本地）Exchange基础结构时，该问题才发生。

Function Connect-Exchange{
PARAM(
    [parameter(Mandatory=$false)]
    [String]$TargetExchange = 'Local'
)
BEGIN{}
PROCESS{
    if ($ExchangeSessionInfo.Session -and $ExchangeSessionInfo.Type -eq $TargetExchange -and $ExchangeSessionInfo.Session.State -eq 'Opened'){
        # Nothing to do, we are already connected.
        Write-Log "Exchange connection type $($TargetExchange) already established, nothing to do."
    } else {
        if ($ExchangeSessionInfo.Session -and $ExchangeSessionInfo.Type -ne $TargetExchange -and $ExchangeSessionInfo.Session.State -eq 'Opened'){
            # We have a open session with the wrong type. We close it.
            Remove-PSSession $ExchangeSessionInfo.Session
            $ExchangeSessionInfo.Session = $null
            $ExchangeSessionInfo.Status = 'undefined'
            $ExchangeSessionInfo.Type = ''
        }
        # We close all other existing Exchange sessions we created.
        get-pssession -Name "Exchange" -ErrorAction SilentlyContinue | remove-pssession

        # Now connect to the requestes Exchange infrastructure and import session.
        $Connected = $False
        $RetryCount = 5
        do{
            try {
                If ($TargetExchange -eq 'Local'){
                    $ExchangeServer = Get-Random -InputObject $LocalExchangeConfig.ExchangeServers
                    $ExchangeSessionInfo.Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "http://$($ExchangeServer)/PowerShell/" -Credential $EOCredentials -Authentication Kerberos -Name "Exchange"
                } else {
                    $ExchangeSessionInfo.Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://ps.protection.outlook.com/powershell-liveid/' -Credential $EOCredentials -Authentication Basic -AllowRedirection -Name "Exchange"
                }
                $Res = Import-PSSession $ExchangeSessionInfo.Session -WarningAction SilentlyContinue -AllowClobber

                # Store Exchange status in session variable.
                $Connected = $True
                $ExchangeSessionInfo.Status = 'connected'
                $ExchangeSessionInfo.Type = $TargetExchange 
            } catch {
                $err = Write-Error -err $error -msg "Could not connect to Exchange server type '$($TargetExchange)' (Retries left: $($RetryCount))." -Break $false
                get-pssession -Name "Exchange" -ErrorAction SilentlyContinue | remove-pssession
                $RetryCount -= 1
            }
        } while (!$Connected -and ($RetryCount -gt 0))          

        # If we do not have connection here, this is an error. 
        if (!$Connected) {
            $ExchangeSessionInfo.Session = $null
            $ExchangeSessionInfo.Status = 'undefined'
            $ExchangeSessionInfo.Type = ''
            throw "No connection to Exchange server (type: $($TargetExchange)) could be established."
        } else {
            # Get list of available mailbox DBs including mailbox count and create hashtable to store statistics. We only have to get it the first time.
            if (($MailboxDBList.count -eq 0) -and ($TargetExchange -eq 'Local')){
                Write-Log "Getting current Exchange DB configuration and mailbox count. Takes a moment."
                $MailboxDBList = Get-MailboxDBCount -Type $LocalExchangeConfig.DistributeMailboxes
            }
        }           
    }
}
END{
    return $ExchangeSessionInfo
}
}

以下代码正在应用一组预定义的Exchange设置：

...                 
$TryCount = 0
$Done = $false
do{
    # It takes a while after enabling mailbox until settings can be applied. So we need to retry.
    try{
        # If we need to execute a setting several times.
        if ($MailboxSetting.LoopOver){
            # We have a loop value (array).
            foreach ($LoopValue in $MailboxSetting.LoopOver){
                # Copy parameter as we have to change a value (loop value).
                $TempParams = $Params.PsObject.Copy()                               
                @($Params.getenumerator()) |? {$_.Value -match '#LOOPVALUE#'} |% {$TempParams[$_.Key]=$LoopValue} 
                $res = & $MailboxSetting.Command -ErrorAction Stop @TempParams -WhatIf:$RunConfig.TestMode
            }
        } else {
# THE PROBLEM HAPPENS HERE
            $res = & $MailboxSetting.Command -ErrorAction Stop @Params -WhatIf:$RunConfig.TestMode
        }
        # Write-Log "Setting command $($MailboxSetting.Command) executed successfully"
        $Done = $true
    } catch{
        $tryCount++
        $res = Write-Error -err $error -msg "Error applying mailbox settings, account: $($AccountDetails.sAMAccountName), retry count: $($TryCount)" -Break $false
        Start-Sleep -s $(($Retires-$TryCount) * 5)
    } 
} while ((!$done) -and ($tryCount -lt $Retires))
...

我确定该错误与代码无关，因为该脚本可以运行数小时而没有问题，并且可以应用所有设置。但是，大约10个小时后，似乎Kerberos票证已过期，因此脚本如果没有重新登录就无法再访问Exchange。

是否可以防止Kerberos票证过期或更新？

任何帮助将不胜感激。

Answer 1

我认为您正在达到域安全策略（组策略对象-GPO）=> security settings/account policy/Kerberos policy的限制。

您有两个有效的选择：

Maximum lifetime for user ticket =>默认值为10小时

Maximum lifetime for user ticket renewal =>默认值为7天（这是可以续签的期限）。

是否可以防止Kerberos票证过期或更新？

对于第一个问题，您“只是”需要将maximum lifetime for user ticket设置调整为您认为合适的值。

第二个比较棘手。我只是通过powershell清除所有kerberos门票。进一步了解-viewing and purging cached kerberos tickets，您会得到一个新的答案。

如果可以续签票，则必须检查RENEABLE flag-您可以通过kinit查看票。也许kinit -R足以续订机票。（我自己没有这样做），您也可以通过kerberos for windows

对其进行续订

编辑-添加klist purge以清除所有Kerberos票证，以便可以对其进行续签。

拥有klist后，您可以通过必须在提升的Powershell提示符下运行清除所有票证（全部功劳归于JaredPoeppelman）：

Get-WmiObject Win32_LogonSession | Where-Object {$_.AuthenticationPackage -ne 'NTLM'} | ForEach-Object {klist.exe purge -li ([Convert]::ToString($_.LogonId, 16))}

然后检查您的TGT是否通过以下方式更新：

klist tgt

注意：您必须在所有地方都使用FQDN名称！

Answer 2

感谢您的建议。在第一次尝试中，我将如下扩展我的代码，并尝试重新建立新的Exchange连接。需要10小时运行脚本以查看其是否有效。

我无法影响域安全策略，此外，由于我不知道脚本运行了多长时间，因此很难设置值。

在我的Windows 2016上，无法识别命令“ kinit”。可能我需要安装其他模块/角色。

s =

    5.0000    5.3000    3.9000

10小时后长时间运行的Exchange Powershell Skript中出现Kerberos错误

2 个答案: