Powershell enable WinRM remotely

user_344669 0
Viewed 1001

I want to enabled winrm CredSSP from remotely to run the ansible script.

if I run this commands one by one in powershell window it works. but when I put all these in powershell script it not working.

Enter-PSSession -ComputerName $ComputerName

Enable-WSManCredSSP -Role Server -Force
Set-Item -Path "WSMan:\localhost\Service\Auth\CredSSP" -Value $true
Invoke-Expression ((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1'))

Exit-PSSession

Any help to make this work as powershell script?

Updated

I copied the file remote server c:\temp dir. when I run the below code its giving this error.

Invoke-Command -session $session -Command {powershell.exe -NoProfile -ExecutionPolicy ByPass -File c:\temp\ConfigureRemotingForAnsible.ps1 -CertValidityDays 3650 -EnableCredSSP -ForceNewSSLCert -Verbose}

Error message

VERBOSE: Enabling basic auth support.
Set-Item : The config setting Basic cannot be changed because is controlled by policies. The
policy would need to be set to "Not Configured" in order to change the config setting.
At C:\temp\ConfigureRemotingForAnsible.ps1:384 char:9
+         Set-Item -Path "WSMan:\localhost\Service\Auth\Basic" -Value $ ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Set-Item], InvalidOperationException
    + FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.SetI
   temCommand

I know this error message coming from the script, any help to fix this error message?

Thanks SR

ansible powershell
2 Answers

The line failing in your ansible script is this, where it's configuring basic auth, not CredSSP:

$basicAuthSetting = Get-Item WSMan:\localhost\Service\Auth\Basic

If (($basicAuthSetting.Value) -eq $false) {
    Set-Item -Path "WSMan:\localhost\Service\Auth\Basic" -Value $true
}

The quick fix is configure without Basic auth (maybe a space instead of a colon here):

c:\temp\ConfigureRemotingForAnsible.ps1 -DisableBasicAuth:$true -CertValidityDays 3650 -EnableCredSSP -ForceNewSSLCert -Verbose

The error in your question is saying that you have a security policy setting disabling Basic auth which overrides the Set-Item command. This is likely done by your domain admins, but can be a local setting as well. You can check for this in a few different ways:

# With the GroupPolicy module installed, run
Get-GPResultantSetOfPolicy -Computer $RemoteComputer -user $username -ReportType Xml -Path c:\temp\gpreport.xml

# Or run gpresult (on the remote computer)
gpresult /scope:computer /h c:\temp\gpreport.html  ## saves to a file
gpresult /scope:computer /v  ## outputs a huge wall of text

Either file should have an entry for Software\Policies\Microsoft\Windows\WinRM\Client where AllowBasic gets set to 0. This is just to confirm the reason it's failing - I don't recommend trying to change these policies.

As one of those security guys I have to recommend not enabling CredSSP delegation or Basic auth in a prod environment unless you know what you're doing.

user_74118850

According to this site,

You can use powershell to "enable"(start) the winrm service, and configure it. You will just have to use WMI to do so; and by WMI, I mean DCOM.

We will just use Enable-PSRemoting since it should do it all for you.

$SessionArgs = @{
     ComputerName  = 'ServerB'
     Credential    = Get-Credential
     SessionOption = New-CimSessionOption -Protocol DCOM
 }
 $MethodArgs = @{
     ClassName     = 'Win32_Process'
     MethodName    = 'Create'
     CimSession    = New-CimSession @SessionArgs
     Arguments     = @{
         CommandLine = "powershell Start-Process powershell -ArgumentList 'Enable-PSRemoting -Force'"
     }
 }
 Invoke-CimMethod @MethodArgs
user_149037540
Related