Remote PowerShell to Windows VM with WinRM

Remote PowerShell to Windows VM with WinRM

The Remote Desktop Protocol is great to access remotely a Windows Server machine. It is great for actions requiring visual but for actions which can be taken from a PowerShell prompt within the server, it would be best to directly access to a remote PowerShell session from our local computer. Today we will see how we use the Windows Remote Management included in Windows Server to gain access to a remote PowerShell session and therefore manage our server from our local computer through PowerShell. This post is composed by four parts:

  1. Open ports on Network Security Group and open ports on VM firewall
  2. Setup the certificate for HTTPS communication with SSL
  3. Configure WinRM
  4. Connect on remote session

1. Open ports on Network Security Group and open ports on VM firewall

For Azure or AWS, on the security group, the port 5986 needs to be open. It is the port used by WinRM for a PowerShell remote connection over HTTPS.

open_port

Next RDP to your VM and open the same port from the firewall manually or by using the following PS command New-NetFirewallRule.

New-NetFirewallRule -Displayname "Allow Remote PSSession" -Direction Inbound -LocalPort 5986 -Protocol TCP -Action Allow

This creates an Inbound rule which allow TCP connections on port 5986.

2. Setup the certificate for HTTPS communication with SSL

To communicate via SSL, we need to create a key and install the cert (containing the public key) on our local machine. Creating a key can be done using New-SelfSignedCertificate.

New-SelfSignedCertificate -DnsName (your server here).ap-southeast-1.compute.amazonaws.com -CertStoreLocation Cert:\LocalMachine\My

Here we are creating a self signed certificate for the server itself and placing the certificate in the local machine in the personal certificates.

Then go to the certificate manager console and export the certificate.

export

Since we have selected LocalMachine\My the certificate will be under Local Computer\Personal\Certificates. Once you have located your certificate, right click > Export > Select do not export private key > Select DER encoded binary X.509 (.CER) > Save somewhere. The wizard will export the certificate into a .cer file which you can copy to your local computer. Once done double click on the certificate to install it. You can place it inside trusted root to avoid the warning prompt when trying to connect to remote to the VM.

3. Configure WinRM

Start by checking that your Windows Server machine has WinRM service running.

winRM

Next register a listener for the remote connection by executing the following in PowerShell.

winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname="(your server here).ap-southeast-1.compute.amazonaws.com";CertificateThumbprint="(your cert thunmbprint)"}'

winrm enumerate winrm/config/Listener can be used to double check that the listener was properly created.

4. Connect on remote session

Now that we have open the ports on the security group and on the VM firewall, we have create a certificate and shared it to the client machine and finally configured WinRM on the host machine, we are ready to make a remote session.
Execute the following command from your local computer to make a remote connection to your server.

Enter-PSSession -ComputerName (your server here).ap-southeast-1.compute.amazonaws.com -Credential Administrator -UseSSL

Instead of entering the session it is also possible to instantiated the session and use it to copy files for example. Start by saving the session into a variable.

<# Copy file from local to host #>
$pssession = New-PSSession -ComputerName (your server here).ap-southeast-1.compute.amazonaws.com -Credential Administrator -UseSSL

Then copy with the following.

Copy-Item 'C:\Users\Kim Serey\Desktop\abc.PNG' -Destination C:\Users\Administrator\Desktop\ -ToSession $pssession

That concludes how we can remotely manage a Windows Server VM.

Conclusion

Today we saw how we could gain access to our server via remote PowerShell session. We also saw how we could upload files to our server from our local machine. Remote sessions are great as they allow us to trigger scripts on the remote server from our local machine without the need to RDP. It can be leveraged to deploy applications, restart applications, download log files or simply to manage the server configuration itself via PowerShell commands. Hope you liked this post, see you next time!

Comments

Post a Comment

Popular posts from this blog

A complete SignalR with ASP Net Core example with WSS, Authentication, Nginx

SignalR with ASP Net Core SignalR is a framework from ASP NET Core allowing us to establish a two way communication between client and server. This two way communication allows the client to send messages to the server but more importantly allows the server to push messages to the client. SignalR makes use of Websocket when available else it falls back to SSE or pulling. Today we will focus on how to setup SignalR to work with WSS, Websocket secure and how we can authenticate the user requesting to connect to our SignalR hub via Webscoket. Getting started with SignalR SSL encryption for Websocket Secure WSS Websocket Authentication with Identity Server 4 SignalR behind Nginx 1. Getting started with SignalR The Hubs are the main components of SignalR. It is an abstraction of a two way communication available for both client and server. Public functions from the hub can be called from the server code and can be called from the client. The frontend NPM package @aspnet/signalr
Keep reading

Microsoft Orleans logs warnings and errors

Microsoft Orleans logs warnings and errors Microsoft Orleans is a framework which helps building distributed system by implementing the actor model together with the concept of virtual actors, taking care of availability and concurrency. If you are unfamiliar with Microsoft Orleans, you can look at my previous blog post explaining the benefits of Microsoft Orleans . Even though Orleans promises to abstract the distributed system problems, there are instances where errors arise without us being able to understand what is going on. Lucky us, the logs are well documented… but only for those who can decrypt them. Today I will go through some of the errors and warnings which can be seen from silo and client so that you too can undestand what is going on. Enjoy! The code used to produce those errors can be found on my GitHub https://github.com/Kimserey/orleans-cluster-consul . 1. Client logs Logs on client appears with address {ip}:0 . 1.1. Can’t find implementation of interface An un
Keep reading

One way to structure Web App built in F# and WebSharper

Image
Architecture for Web App built in F# and WebSharper F# + WebSharper is an awesome combination to build web application . The only problem is that if you want to build a web app larger than a to-do list, it’s hard to find examples to use as references. It is even harder to find tutorials that touches on overall design and answer questions like: How should I start? Where should I put the code? How should I separate the code, put it in different files, with different namespaces or modules? How many layers? Asking these questions at the beginning of the development is important. All these questions if answered correctly will lead to a good structure for the application. Answered incorrectly, or not even asked, will most likely lead to unmaintainable/fragile/rigid (or whatever bad adjectives for coding) code. Over the last few months, I have been working on a web app built in F# with WebSharper and came out with an architecture that caters to extensions and decoupling. Today, I wil
Keep reading