Proxy Credentials on the Second PowerShell Hop

A web request that works interactively on server B can receive 407 when the same command runs there through PowerShell remoting. Logging in from A to B does not automatically delegate that identity for B’s next authentication exchange.

A → remoting session on B → HTTP proxy → website

One supported design is to supply the proxy account explicitly for the outbound request. With an existing PSSession and an appropriately obtained PSCredential object:

Invoke-Command -Session $session -ArgumentList $proxyCredential -ScriptBlock {
    param([pscredential]$outboundProxyCredential)

    $requestOptions = @{
        Uri = 'https://api.example/'
        Proxy = 'http://proxy.example:8080'
        ProxyCredential = $outboundProxyCredential
    }
    Invoke-WebRequest @requestOptions
}

The credential object is for the proxy’s intended account. The session still uses its normal remoting authentication, and any website login remains part of that website request.

This avoids relying on automatic delegation of the first login. It does require the remote host to handle the supplied account material as part of the intended administration design. Other architectures, such as a managed RunAs endpoint or constrained service access, have their own configuration requirements.

If default proxy credentials were the failing assumption, record the account under which the remote command runs and the authentication the proxy requests. A longer web-request timeout cannot supply missing credentials.

Proxy options on New-PSSessionOption concern the remoting connection itself. Configure Invoke-WebRequest inside the remote script block when B’s outward web connection is the one that needs the proxy.