Powershell remoting permissions for non privileged users (terminal services)

i'd able grant non privileged users (helpdesk staff) ability run commands remotely on terminal servers using powershell remoting.  our helpdesk has ability run simple "query session" while logged terminal server (giving them list of logged in users), cannot run remotely (error message below).  goal give them ability discover (and logoff if necessary) logged terminal server without having rdp in, load terminal server manager , connect session broker etc etc.

as domain admin & server administrator, have ability run command - helpdesk not (they member of remote desktop users local group)

command (from xp machine w/ powershell 2.0):

invoke-command { query session } -computer server04

error message:

[server04] connecting remote server failed following error message : access denied. more information, see about_remote_troubleshooting topic.
    + categoryinfo          : openerror: (:) [], psremotingtransportexception
    + fullyqualifiederrorid : pssessionstatebroken

server configuration:

- server 2008 r2 enterprise x86
- powershell 2.0 installed
- winrm default configuration (just ran [enable-psremoting -force] script)

things i've tried:
- granting dcom remote launch permissions (http://msdn.microsoft.com/en-us/library/aa393266%28vs.85%29.aspx )
- setting wmi namespace security (http://msdn.microsoft.com/en-us/library/aa393613%28v=vs.85%29.aspx )

i'm not sure set minimum required permissions on server (or how configure winrm) allow them run commands.  it's important allow commands have permission run locally, run remotely.

thanks can offer.

richard mckenzie

http://msgoodies.blogspot.com/2009/09/using-ps-session-without-having.html

Windows Server  >  Windows PowerShell