What permissions are needed on the client side for RunspaceFactory.CreateRunspace?

Question

Hi.
I am running a remote powershell command from an IIS application to an Exchange server getting the below error. Everything works fine if the IIS application pool identity is in the local administrators group on the IIS server so we can rule out issues with
firewall or anything on the Exchange server. It is a problem with lack of privileges on the local server. 
So my question is: What permissions are required on the local server for RunspaceFactory.CreateRunspace? I find good documentation on the permissions required on the server side, but nothing about the client side.
The last Win32 error code after failure is 1008.
An internal error occurred. 
at at System.Management.Automation.Remoting.Client.WSManClientSessionTransportManager.Initialize(Uri connectionUri, WSManConnectionInfo connectionInfo) 
at System.Management.Automation.Remoting.Client.WSManClientSessionTransportManager..ctor(Guid runspacePoolInstanceId, WSManConnectionInfo connectionInfo, PSRemotingCryptoHelper cryptoHelper) 
at System.Management.Automation.Remoting.ClientRemoteSessionDSHandlerImpl..ctor(ClientRemoteSession session, PSRemotingCryptoHelper cryptoHelper, RunspaceConnectionInfo connectionInfo, URIDirectionReported uriRedirectionHandler) 
at System.Management.Automation.Remoting.ClientRemoteSessionImpl..ctor(RemoteRunspacePoolInternal rsPool, URIDirectionReported uriRedirectionHandler) 
at System.Management.Automation.Internal.ClientRunspacePoolDataStructureHandler..ctor(RemoteRunspacePoolInternal clientRunspacePool, TypeTable typeTable) 
at System.Management.Automation.Runspaces.Internal.RemoteRunspacePoolInternal..ctor(Int32 minRunspaces, Int32 maxRunspaces, TypeTable typeTable, PSHost host, PSPrimitiveDictionary applicationArguments, RunspaceConnectionInfo connectionInfo) 
at System.Management.Automation.Runspaces.RunspacePool..ctor(Int32 minRunspaces, Int32 maxRunspaces, TypeTable typeTable, PSHost host, PSPrimitiveDictionary applicationArguments, RunspaceConnectionInfo connectionInfo) 
at System.Management.Automation.Runspaces.RunspaceFactory.CreateRunspacePool(Int32 minRunspaces, Int32 maxRunspaces, RunspaceConnectionInfo connectionInfo, PSHost host, TypeTable typeTable, PSPrimitiveDictionary applicationArguments) 
at System.Management.Automation.RemoteRunspace..ctor(TypeTable typeTable, RunspaceConnectionInfo connectionInfo, PSHost host, PSPrimitiveDictionary applicationArguments) 
at System.Management.Automation.Runspaces.RunspaceFactory.CreateRunspace(RunspaceConnectionInfo connectionInfo, PSHost host, TypeTable typeTable, PSPrimitiveDictionary applicationArguments) 
at System.Management.Automation.Runspaces.RunspaceFactory.CreateRunspace(RunspaceConnectionInfo connectionInfo) 

Answer 1

Thanks Daniel.
I see that the IIS server has a GPO setting 'Allow log on locally' to the local administrators group for this server. I will order add of the IIS app pool identity to this list.
I tried the process monitor comparing runs with and without the app pool identity as local administrator. The runs are identical up to the point where one does something useful and the other closes 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN'.
There are no failures.
I am not using my runspace objects for multiple threads. I dispose after use.
I will end up with the below if I change. Comments?
public static PowershellResult RunPowerShellCommandExchange2010(string exchangeServer, string command, ICollection<KeyValuePair<string, object>> parameters, string usr, string pwd) {
WindowsImpersonationContext impersonationContext = null;
try {
impersonationContext = WindowsIdentity.Impersonate(IntPtr.Zero);
GetProcessInformation();
try {
var connectionInfo = GetExchange2010ConnectionInfo(exchangeServer, usr, pwd);
using (var runspace = RunspaceFactory.CreateRunspacePool(1, 1, connectionInfo)) {
using (PowerShell powershell = PowerShell.Create()) {
var psCommand = new PSCommand();
if (parameters != null) {
psCommand.AddCommand(command);
foreach (KeyValuePair<string, object> parameter in parameters) {
if (parameter.Value == null) psCommand.AddParameter(parameter.Key);
else psCommand.AddParameter(parameter.Key, parameter.Value);
} else {
//if parameters argument is null the command will be treated as script
psCommand.AddCommand(new Command(command, true));
powershell.Commands = psCommand;
runspace.Open();
powershell.RunspacePool = runspace;
var resultPSObjects = powershell.Invoke();
var psResult = new PowershellResult {
PSObjects = resultPSObjects,
Errors = powershell.Streams.Error.ToList()
return psResult;
} catch (Exception ex) {
var windowsIdentity = WindowsIdentity.GetCurrent();
int errorCode = Marshal.GetLastWin32Error();
if (windowsIdentity != null) throw new Exception(string.Format("Failed to run Exchange powershell command '{0}' as user {1} passing executing user {2} due to: {3} at {4}. Server: {5}. Last error code: {6}", command, windowsIdentity.Name, usr, ex.Message, ex.StackTrace, exchangeServer, errorCode), ex);
throw new Exception(string.Format("Failed to run Exchange powershell command '{0}' as unknown user passing executing user {1} due to: {2} at {3}. Server: {4}. Last error code: {5}", command, usr, ex.Message, ex.StackTrace, exchangeServer, errorCode), ex);
} finally {
if (impersonationContext != null) {
impersonationContext.Undo();
Tore Olav Kristiansen