Explanation:
User1 can establish a PowerShell remoting session from Server1 to Server2. Yes User2 can establish a PowerShell remoting session from Server2 to DC1. No User3 can establish a PowerShell remoting session from Server1 to Server2. No PowerShell Remoting (WinRM) security and connectivity are central themes in the Administering Windows Server Hybrid Core Infrastructure curriculum. The ability to establish a remote session is determined by three factors: the service state on the target, the network path, and the user's effective permissions.
* User1 (Server1 to Server2): On Server2, the Enable-PSRemoting cmdlet has been executed. By default, this configures the WinRM service to allow connections from members of the local Administrators group. Since User1 is a member of the Contoso\Administrators group, and this domain group is a member of the local Administrators group on all member servers by default, User1 has the necessary rights to establish a session to Server2.
* User2 (Server2 to DC1): While User2 is a member of the Contoso\Remote Management Users group-a group specifically designed to provide non-administrative users with remoting access-the scenario explicitly states that Enable-PSRemoting was run only on Server2. For any user to establish a remoting session to DC1, the WinRM listener must first be enabled and configured on that specific target. Because the prompt does not indicate that remoting was enabled on DC1, the connection will fail regardless of User2's group membership.
* User3 (Server1 to Server2): User3 is a member of the local Server2\Power Users group. According to official documentation, the Power Users group does not possess the default permissions required to access the WinRM endpoints (Microsoft.PowerShell or Microsoft.Windows.ServerManager). Only members of the local Administrators or Remote Management Users groups are granted these rights when Enable-PSRemoting is executed. Therefore, User3 cannot establish the session.