remote deploy sandbox

Question

I am trying to set up TFS build to deploy our solution to test server. The build executes some scripts remotely (from build server) on the test server. Everything works, including commands like New-SPSite, etc; except Add-SPUserSolution. That one always returns Access Denied when invoked remotely. The command is correct and the user account has sufficient rights, because it works when I log on the test server under those credentials and execute it manually directly on the server. I have followed this guide to set it up

The PowerShell script for remote invocation looks as follows:

$secpasswd = ConvertTo-SecureString "ZZZ" -AsPlainText -Force; 
$cred = New-Object System.Management.Automation.PSCredential ("ZZZ\AutomaticDeployment", $secpasswd);

...

invoke-command -Args ($localDropLocationOnTest, $siteUrl) -script{
    param($DropLocation, $siteUrl)
        # this already runs on test server .

       #this builds up path like C:\folder\_fullDeploy.ps1, which in turn calls Add-SPUserSolution -LiteralPath $Solution -Site $SiteURL -ErrorAction:SilentlyContinue -ErrorVariable myError -Confirm:$false. This fails when called from here, but works when called locally under the same credentials. Other commands, like New-SPSite work properly
       $script = Join-Path $DropLocation "_fullDeploy.ps1"
       . "$script"  -siteUrl $siteUrl -wspDropFolder $DropLocation -location $DropLocation
} -ComputerName "servername" -auth CredSSP -cred $cred

Any idea what am I missing (probably some rights for remote script execution)? Your help would be very appreciated!

Answer 1

I have managed to resolve this myself. What helps is to stop calling the script directly within the remote call, but let the script open a new powershell instance on the test server and execute the script there. If you are interested, you can find the updated script below. Thanks everyone who invested any time in this.

$secpasswd = ConvertTo-SecureString "ZZZ" -AsPlainText -Force; 
$cred = New-Object System.Management.Automation.PSCredential ("ZZZ\AutomaticDeployment", $secpasswd);

...

invoke-command -Args ($localDropLocationOnTest, $siteUrl) -script{
  param($DropLocation, $siteUrl)
  # this already runs on test server .

  #strange thig is that this works properly already here, no rights issue
  New-SPSite New-SPSite -Url $siteUrl -OwnerAlias "ZZZ\automaticdeploy"

  #this builds up path like C:\folder\_fullDeploy.ps1, which in turn calls Add-SPUserSolution -LiteralPath $Solution -Site $SiteURL -ErrorAction:SilentlyContinue -ErrorVariable myError -Confirm:$false
  $script = Join-Path $DropLocation "_fullDeploy.ps1"
  #do not run the script directly, but open new PowerShell instance for it - then also Add-SPUserSolution starts to work
  PowerShell "$script -siteUrl $siteUrl -wspDropFolder $DropLocation -location $DropLocation"

} -ComputerName "servername" -auth CredSSP -cred $cred