Powershell - Remote commands using WinRM

Powershell - Remote commands using WinRM

Would you like to learn how to execute remote commands using Powershell? In this tutorial, we are going to show you how to use the WinRM feature to execute remote commands using Powershell on a computer running Windows.

• Windows 2012 R2 • Windows 2016 • Windows 2019 • Windows 10 • Windows 7

Equipment list

The following section presents the list of equipment used to create this tutorial.

• Server

• Network Switch

• Laptop

As an Amazon Associate, I earn from qualifying purchases.

Related tutorial - PowerShell

On this page, we offer quick access to a list of tutorials related to PowerShell.

• List of Tutorials - Powershell

• List of Tutorials - Windows

• PowerShell - Upgrade

• PowerShell - Base64 encoding

• PowerShell - Downloading a file

• PowerShell - Display a pop-up message

• PowerShell - Installing the Remote Server Administration Tools

• PowerShell - Creating a local user account

• PowerShell - Creating an Environment variable

• PowerShell - Edit the PATH environment variable

• PowerShell - Installing PowerShell 7

• PowerShell - Changing the execution policy

• Powershell - Test the TCP port connectivity

• Powershell - Download files from FTP server

• Powershell - Upload files to FTP server

• Powershell - Get the HTTP headers

• Powershell - List the open TCP ports

• Powershell - List the open UDP ports

• Powershell - Translate DNS to IP address

• Powershell - Translate IP address to hostname

• PowerShell - Repeat the command every 5 seconds

• Powershell - Read lines from a text file

• Powershell - Add user photo in Active Directory

• Powershell - Show services information

• Powershell - Get the processes information

• PowerShell - Send email

• Powershell - Send email using Gmail

• Powershell - Send email using Office 365

• Powershell - Finding user accounts recently created

• Powershell - Finding users who did not change password

• Powershell - Find inactive users in Active Directory

• Powershell - Find inactive computers in Active Directory

• Powershell - Get computers information from Active Directory

• Powershell - Get user information from Active Directory

• Powershell - Get the user SID

• Powershell - Get the computer temperature

• Powershell - Discover your public IP address

• Powershell - Mount an ISO file

• PowerShell - Installation on Linux

Tutorial Powershell - Enable the WinRM service

Access the server where you want to execute remote commands.

As an Administrator, start a Powershell command-line.

Enable the WinRM service.

Copy to Clipboard

Enable-PSRemoting -Force

Verify the network configuration of the WinRM service.

Copy to Clipboard

winrm enumerate winrm/config/listener

Here is the command output.

Copy to Clipboard

Listener

    Address = *

    Transport = HTTP

    Port = 5985

    Hostname

    Enabled = true

    URLPrefix = wsman

    CertificateThumbprint

    ListeningOn = 127.0.0.1, 172.31.40.72, ::1

In our example, the WinRM service is listening on the TCP port 5985.

In our example, the WinRM service is allowing HTTP connections.

Verify the WinRM service configuration

Copy to Clipboard

winrm get winrm/config/service

Here is the command output.

Copy to Clipboard

Service

    RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)

    MaxConcurrentOperations = 4294967295

    MaxConcurrentOperationsPerUser = 1500

    EnumerationTimeoutms = 240000

    MaxConnections = 300

    MaxPacketRetrievalTimeSeconds = 120

    AllowUnencrypted = false

    Auth

        Basic = false

        Kerberos = true

        Negotiate = true

        Certificate = false

        CredSSP = false

        CbtHardeningLevel = Relaxed

    DefaultPorts

        HTTP = 5985

        HTTPS = 5986

    IPv4Filter = *

    IPv6Filter = *

    EnableCompatibilityHttpListener = false

    EnableCompatibilityHttpsListener = false

    CertificateThumbprint

    AllowRemoteAccess = true

Test the local connection to the WinRM service.

Copy to Clipboard

Test-WsMan 127.0.0.1

Here is the command output.

Copy to Clipboard

wsmid           : http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd

ProtocolVersion : http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd

ProductVendor   : Microsoft Corporation

ProductVersion  : OS: 0.0.0 SP: 0.0 Stack: 3.0

Congratulations! You are able to enable the WinRM service to allow remote commands using Powershell.

Tutorial WinRM - Remote commands using Powershell.

On the client computer, start a Powershell command-line.

Test the connection to the remote computer on the TCP port 5985.

Copy to Clipboard

(New-Object System.Net.Sockets.TcpClient).ConnectAsync('52.37.189.81', 5985).Wait(1000)

Here is the command output.

Copy to Clipboard

True

Test the connection to the remote WinRM service.

Copy to Clipboard

Test-WSMan -ComputerName 52.37.189.81

Here is the command output.

Copy to Clipboard

wsmid           : http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd

ProtocolVersion : http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd

ProductVendor   : Microsoft Corporation

ProductVersion  : OS: 0.0.0 SP: 0.0 Stack: 3.0

Execute a remote command using WinRM and Powershell.

Copy to Clipboard

Invoke-Command -ComputerName 52.37.189.81 -ScriptBlock { ipconfig } -credential administrator

Enter the credentials to access the remote computer.

Here is the command output.

Copy to Clipboard

Windows IP Configuration

​

Ethernet adapter Ethernet 2:

​

   Connection-specific DNS Suffix  . : us-west-2.compute.internal

   Link-local IPv6 Address . . . . . : fe80::3190:ec1b:2d19:2aa0%12

   IPv4 Address. . . . . . . . . . . : 172.31.7.220

   Subnet Mask . . . . . . . . . . . : 255.255.240.0

   Default Gateway . . . . . . . . . : 172.31.0.1

In our example, a single command was executed remotely using WinRM and Powershell.

Execute a remote command using a stored credential.

Copy to Clipboard

$userName = '[email protected]'

$password = '123qwe..'

[SecureString]$securepassword = $password | ConvertTo-SecureString -AsPlainText -Force 

$credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username, $securepassword

Invoke-Command -ComputerName 52.37.189.81 -ScriptBlock { ipconfig } -credential $credential

There are multiple ways to use Powershell, WinRM, and a stored credential.

Copy to Clipboard

$credential = New-Object System.Management.Automation.PSCredential -ArgumentList @('[email protected]',(ConvertTo-SecureString -String '123qwe..' -AsPlainText -Force))

Invoke-Command -ComputerName 52.37.189.81 -ScriptBlock { ipconfig } -credential $credential

Congratulations! You are able to use WinRM to send remote commands using Powershell.

Tutorial WinRM - Remote session using Powershell.

On the client computer, start a Powershell command-line.

Test the connection to the remote computer on the TCP port 5985.

Copy to Clipboard

(New-Object System.Net.Sockets.TcpClient).ConnectAsync('52.37.189.81', 5985).Wait(1000)

Here is the command output.

Copy to Clipboard

True

Test the connection to the remote WinRM service.

Copy to Clipboard

Test-WSMan -ComputerName 52.37.189.81

Here is the command output.

Copy to Clipboard

wsmid           : http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd

ProtocolVersion : http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd

ProductVendor   : Microsoft Corporation

ProductVersion  : OS: 0.0.0 SP: 0.0 Stack: 3.0

Start a remote session using Powershell and WinRM.

Copy to Clipboard

Enter-PSSession -ComputerName 52.37.189.81 -Credential administrator

Enter the credentials to access the remote computer.

Here is the command output.

Copy to Clipboard

[52.37.189.81]: PS C:\Users\Administrator.TECH\Documents>

In our example, a remote session was started using WinRM and Powershell.

Start a remote session using a stored credential.

Copy to Clipboard

$userName = '[email protected]'

$password = '123qwe..'

[SecureString]$securepassword = $password | ConvertTo-SecureString -AsPlainText -Force 

$credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username, $securepassword

Enter-PSSession -ComputerName 52.37.189.81 -Credential $credential

There are multiple ways to use Powershell, WinRM, and a stored credential.

Copy to Clipboard

$credential = New-Object System.Management.Automation.PSCredential -ArgumentList @('[email protected]',(ConvertTo-SecureString -String '123qwe..' -AsPlainText -Force))

Enter-PSSession -ComputerName 52.37.189.81 -Credential $credential

Congratulations! You are able to use WinRM to start a remote session using Powershell.