Remote file share access fails from a remoting session
Documentation: Microsoft Learn
Work the problem
The first hop works
Fictional case: You can open a session on Server A. Accessing a share on Server B inside that session fails, although the intended user can access it interactively.
Reasoning notebook
Record the evidence that supports your answer and the check you would run next. Your notes stay in this browser — nothing is uploaded.
Why it happens
Credentials presented to the first hop cannot be forwarded to a second one by default, because the remote session holds a network logon token with no reusable secret attached to it. The file server therefore sees an anonymous or machine-account attempt and refuses. This is a deliberate protection against credential theft rather than something misconfigured.
Check this first
What to look for
Successful authentication to A does not automatically provide reusable credentials for B. Check the actual access identity and delegation design.
Permission boundary diagram
Why the second server sees no usable user credential
Genie: separate an ACL problem from a credential-delegation problem.
Safer direction: prefer designs that avoid forwarding reusable credentials. Use constrained delegation where appropriate, or transfer through the existing session when that fits the job.
Working through it
Confirm the same resource works under the intended identity outside the first-hop session. Then inspect the identity and authentication path of the failing request; group membership alone does not prove that reusable credentials were delegated.
For file transfer, Copy-Item -ToSession or -FromSession can avoid a remote server opening a second connection. If delegation is actually required, select a supported design for the destination service. Resource-based constrained delegation is not a general solution for a second WinRM hop. CredSSP delegates credentials and requires an explicit trust decision.
Avoiding it next time
Verify the repair: Verify access under the intended remote identity. If transferring a file, consider Copy-Item through the existing PSSession to avoid a second hop.