PowerShell远程清理服务器临时文件夹遇凭据委派错误求助

Hey there, let's break down how to fix your CredSSP delegation errors and optimize your cleanup script at the same time.

First, Let's Fix the CredSSP Configuration Issues #

The error "A computer policy does not allow the delegation of the user credentials to the target computer" usually stems from missing or incorrect group policy settings, plus a possible typo in your PowerShell command.

Step 1: Correct the Client CredSSP Enable Command (on SRV01)

You mentioned using Enable-WSManCredSSP -Role Client -DelegatedCredentials 'SRV01' — that's a mistake. The correct parameter is -DelegateComputer, and you need to target the remote servers (SRV02, SRV03), not the local one. Run this instead:

Enable-WSManCredSSP -Role Client -DelegateComputer "SRV02", "SRV03"
# Or use FQDN for better reliability, e.g., "SRV02.yourdomain.com"

Also, make sure CredSSP auth is enabled in WinRM on the client:

Set-Item WSMan:\localhost\Client\Auth\CredSSP -Value $true

Step 2: Fix Group Policy Settings (on SRV01)

Open gpedit.msc and navigate to these two policies, enable both and add the correct entries:

1. Computer Configuration > Administrative Templates > System > Credentials Delegation > Allow delegating fresh credentials
   • Add WSMAN/SRV02 and WSMAN/SRV03 (or their FQDNs) to the server list.
2. Computer Configuration > Administrative Templates > System > Credentials Delegation > Allow delegating fresh credentials with NTLM-only Server Authentication
   -同样添加 WSMAN/SRV02 和 WSMAN/SRV03 到列表中。

To answer your question directly: Yes, you should replace WSMAN/BuildServerName with WSMAN/SRV02 (and WSMAN/SRV03) — the entry must match the exact target server name (or FQDN) you're delegating credentials to.

Step 3: Verify Server-Side Configuration (on SRV02 and SRV03)

Make sure you've run this on both remote servers, then restart the WinRM service to apply changes:

Enable-WSManCredSSP -Role Server
Restart-Service WinRM -Force

Second, Optimize Your Cleanup Script #

Your original script uses scheduled tasks on remote machines, which adds unnecessary complexity and can introduce extra permission hurdles. Since you're already using Invoke-Command, you can run the cleanup directly in the remote session with CredSSP auth:

# Define target servers and temp folders
$targetServers = @("SRV02", "SRV03")
$tempFolders = @(
    "C:\Windows\Temp\*",
    "C:\Documents and Settings\*\Local Settings\Temp\*"
)

# Execute remote cleanup with CredSSP authentication
Invoke-Command -ComputerName $targetServers -ScriptBlock {
    param($foldersToClean)
    Write-Host "Starting cleanup on $($env:COMPUTERNAME)..."
    foreach ($folder in $foldersToClean) {
        # Silently skip errors (e.g., locked files)
        Remove-Item -Path $folder -Force -Recurse -ErrorAction SilentlyContinue
        Write-Host "Processed folder: $folder"
    }
} -ArgumentList $tempFolders -Authentication CredSSP

Why This Works #

• Using -Authentication CredSSP allows your local credentials to be delegated to the remote servers, which is required for operations that need elevated or network access on the remote side.
• Ditching the scheduled task removes extra layers of permission checks, making the script simpler and more reliable.

After applying these fixes, run the optimized script — it should handle the cleanup without the delegation errors.

内容的提问来源于stack exchange，提问作者TurboCoder