WinRM - Windows Remote Management ( Part 1 - Ansible Windows Automation)

Mai 16, 2021 - Lesezeit: 46 Minuten

WinRM - Windows Remote Management (Ansible Windows Automation)

Check if WimRM is Running via Powershell (elevated):

dir wsman:\localhost\listener

in my case the WinRM with HTTP is running.



Remove the existing WinRM Service via Powershell:

for HTTP:

dir WSMan:\Localhost\listener | where Keys -eq "Transport=HTTP" | Remove-Item –Recurse

For HTTPS:

dir WSMan:\Localhost\listener | where Keys -eq "Transport=HTTPS" | Remove-Item –Recurse

 

Generate a self-signed certificate for the server:

First check the hostname this will be the CN/DNS name for the certificate via Powershell:

Hostname

Create an certificate for the host via Powershell:

Important, in my LAB setup: Client Windows 10 German with German Time and Server Windows Server 2019 Std. Englisch with UTC time. Caused an problem with using server certificates which were created on the server and were not valid on the Clients until I changed the server time to UTC+01 Berlin.

$Cert = New-SelfSignedCertificate -CertstoreLocation Cert:\LocalMachine\My -DnsName $env:COMPUTERNAME

You can check the certificate was createt by the windows certlm:

 

 

Start the WinRM Service with HTTPS and valid certificate via Powershell:

New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Cert.Thumbprint –Force

Check if the service is running:

dir wsman:\localhost\listener

Adding Firewall input rule to the Windows Firewall (Port 5986):

New-NetFirewallRule -DisplayName "Windows Remote Management (HTTPS-In)" -Name "Windows Remote Management (HTTPS-In)" -Profile Any -LocalPort 5986 -Protocol TCP

 

Exporting the Certificate for the automation servers:

Export-Certificate -Cert $Cert -FilePath C:\$env:COMPUTERNAME.der

 

Move the Certificate to your windows client and import it via Powershell (elevated):

Import-Certificate -Filepath "<directory of your cert.der>" -CertStoreLocation "Cert:\LocalMachine\Root"

Test the connection to the server via Powershell:
keep in mind to set the hostname to your hosts of the server is not in your DNS or behind VPN

Enter-PSSession -ComputerName <DNS Hostname> -UseSSL -Credential (Get-Credential)

After Typing in your credentials you have access to the Powershell of the remote server.

You can use this command with credentials in the shell if your security polices allow that the passwords will stay in the history:

winrs -r:https://<DNS Hostname>:5986/wsman -u:<Username> -p:<Password> ipconfig