Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
tutorial:adm:configuration_-_winrm [2024/01/30 06:06] – erbenrtutorial:adm:configuration_-_winrm [2025/10/07 10:28] (current) – [Permission configuration] klimad
Line 9: Line 9:
 <code powershell> <code powershell>
 Test-WSMan Test-WSMan
 +
  
 </code> </code>
Line 15: Line 16:
  
 If you get some error then you need to do the [[https://docs.microsoft.com/en-us/windows/desktop/winrm/installation-and-configuration-for-windows-remote-management#quick-default-configuration|quick default configuration]] If you get some error then you need to do the [[https://docs.microsoft.com/en-us/windows/desktop/winrm/installation-and-configuration-for-windows-remote-management#quick-default-configuration|quick default configuration]]
 +<code>
 +
 +winrm quickconfig
 +
 +</code>
  
 Now execute the first command again and it should without error now. Now execute the first command again and it should without error now.
 +
  
 ===== Show current configuration ===== ===== Show current configuration =====
Line 92: Line 99:
  
 <code powershell> <code powershell>
-winrm set winrm/config/service/auth '@{CredSSP="true"}'===  === +winrm set winrm/config/service/auth '@{CredSSP="true"}'
-{{.:winrm_wmi2.png?400|Level 4 Headline}}+
 winrm set winrm/config/client/auth '@{CredSSP="true"}' winrm set winrm/config/client/auth '@{CredSSP="true"}'
 Enable-WSManCredSSP -Role Server Enable-WSManCredSSP -Role Server
- 
 </code> </code>
- 
 ===== Permission configuration ===== ===== Permission configuration =====
  
Line 105: Line 109:
 Now we need to set the right permissions. It's tested against NTLM, Kerberos and CredSSP auth It's tested with local user + group and with domain user + group. For the following steps you can use one of these groups WinRMRemoteWMIUsers\_\_ or Remote Management Users It should work with both. Now we need to set the right permissions. It's tested against NTLM, Kerberos and CredSSP auth It's tested with local user + group and with domain user + group. For the following steps you can use one of these groups WinRMRemoteWMIUsers\_\_ or Remote Management Users It should work with both.
  
-Assign user into group Set WMI access for group.+**Assign WinRM user into group WinRMRemoteWMIUsers__ or Remote Management Users**
  
-* Computer Management → Services and Application → right click WMI Control → Properties * In new dialog window → tab Security → Root → CIMV2 and click button Security * Next dialog window will appear - you need to add group (WinRMRemoteWMIUsers\_\_ or Remote Management Users) here * You need to select these options in the checkboxes - Execute Methods, Enable Account and Remote Enable * Click on Advanced - select and edit group → Set "Applies to" This namespace and subnamespaces * Confirm all changes in dialog windows and close them+Set WMI access for group. 
 + 
 +  * Computer Management → Services and Application → right click WMI Control → Properties  
 +  * In new dialog window → tab Security → Root → CIMV2 and click button Security 
 +  * Next dialog window will appear - you need to add group (WinRMRemoteWMIUsers\_\_ or Remote Management Users) here 
 +  * You need to select these options in the checkboxes - Execute Methods, Enable Account and Remote Enable 
 +  * Click on Advanced - select and edit group → Set "Applies to" This namespace and subnamespaces 
 +  * Confirm all changes in dialog windows and close them
  
 {{.:winrm_wmi.png?nolink&600}}{{.:winrm_wmi2.png?nolink&800}} {{.:winrm_wmi.png?nolink&600}}{{.:winrm_wmi2.png?nolink&800}}
Line 118: Line 129:
 </code> </code>
  
-{{.:winrm_sddl.png?nolink&400}}* Add group (WinRMRemoteWMIUsers\_\_ or Remote Management Users) and give it Full Control * Confirm changes Restart WinRM+{{.:winrm_sddl.png?nolink&400}} 
 +  * Add group (WinRMRemoteWMIUsers\_\_ or Remote Management Users) and give it Full Control 
 +  * Confirm changes Restart WinRM
  
 <code powershell> <code powershell>
Line 214: Line 227:
 </code> </code>
  
-To turn the credentials delegation on. Open Group policy setting and navigate to Computer ConfigurationAdministrative templateWindows ComponentsWindows Remote Management (WinRM)WinRM Service.+To turn the credentials delegation on. Open Group policy setting and navigate to Computer Configuration\Administrative Templates\System\Credentials Delegation.
  
 The Allow Delegating Fresh Credentials (AllowFreshCredentials) policy setting must be enabled. If it's enabled validate if correct value (values) are added to this policy. The correct value is WSMAN/SPN of your server. For example The Allow Delegating Fresh Credentials (AllowFreshCredentials) policy setting must be enabled. If it's enabled validate if correct value (values) are added to this policy. The correct value is WSMAN/SPN of your server. For example
Line 312: Line 325:
 Now we have certificate which is imported in our windows server and now we can configure the HTTP listener Now we have certificate which is imported in our windows server and now we can configure the HTTP listener
  
 +Create and export self signed certificate with powershell:
 +<code powershell>
 +$pathToCertificate="C:\Users\Administrator.ZOO\Desktop\certificate"  ## Specify your preferred location for export
 +$hostname='ad.idstory.idm' #hostname your machine
 +$params = @{
 +    Subject = "CN=winrm.$hostname"
 +    DnsName = 'ad.idstory.idm'
 +    CertStoreLocation = 'Cert:\LocalMachine\My' #Certificate for WinRM, must be in stored in Local Computers
 +    KeyExportPolicy ='Exportable' 
 +    KeySpec ='Signature' 
 +    KeyLength ='2048'
 +    KeyAlgorithm = 'RSA'
 +    HashAlgorithm = 'SHA256'
 +}
 +
 +$cert = New-SelfSignedCertificate @params
 +Export-Certificate -Cert $cert -FilePath "$pathToCertificate\$hostname.cer" 
 +$mypwd = ConvertTo-SecureString -String "{myPassword}" -Force -AsPlainText  ## Replace {myPassword}
 +Export-PfxCertificate -Cert $cert -FilePath "$pathToCertificate\$hostname.pfx" -Password $mypwd
 +</code>
 +
 +List certificate in windows certificate storage:
 +<code powershell>
 +Get-ChildItem -Path Cert:\LocalMachine\My -Recurse #List certificate stored in Local Computer, and copy certificate thumbrint
 +</code>
 +
 +Configure WinRM listener with HTTPS certficate:
 <code powershell> <code powershell>
 winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname="HOSTNAME";CertificateThumbprint="THUMBPRINT"}' winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname="HOSTNAME";CertificateThumbprint="THUMBPRINT"}'
 for deleting for deleting
 winrm delete winrm/config/Listener?Address=*+Transport=HTTPS winrm delete winrm/config/Listener?Address=*+Transport=HTTPS
 +</code>
  
 +Create firewall rule for WinRM HTTPS:
 +<code powershell>
 +New-NetFirewallRule -Displayname 'WinRM - Powershell remoting HTTPS-In' -Name 'WinRM - Powershell remoting HTTPS-In' -Profile Any -LocalPort 5986 -Protocol TCP
 </code> </code>
  
 Restart WinRM Restart WinRM
- 
 <code powershell> <code powershell>
 Restart-Service winrm Restart-Service winrm
- 
 </code> </code>
  
Line 329: Line 371:
  
  
 +===== Powershell 7 support =====
 +
 +Install powershell 7: https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-windows?view=powershell-7.4#installing-the-msi-package
 +
 +Run app ''C:\Program Files\PowerShell\7\pwsh.exe'' and execute
 +<code powershell>
 +Enable-PSRemoting 
 +</code>
  
  
  • by erbenr