So let's talk about enabling PowerShell Remoting so we can
execute some of these commands and use some of those
benefits that are offered to us.
So first off, we have to understand remote connections and what that means.
Now PowerShell Remoting was primarily designed for
connecting and managing server farms, etc.,
workstations within an enterprise environment, somewhere where there's an
Active Directory server. So you have an Active Directory server,
you have servers that are connected to that domain as members, and you
have workstations that are also connected. That's what it was
originally designed for because there's inherent trust built in to the
workstations, and the domain, and the servers, and so passing
credentials doesn't tend to be an issue because we're all part of the
same happy family. Now, PowerShell Remoting works great that way; however,
it can also work in environments where we're not members of a domain or we're
in a different platform other than Windows. To achieve this, there are three
kind of protocols that are used for the connections.
The first one, I already mentioned this, is HTTP, which
is the Windows 10 default option.
So if you want to enable PowerShell Remoting, the default connection is
HTTP. Now, of course, we can change that one to HTTPS. This will require
you as IT at Globomantics to acquire, provision, and manage certificates
in order for that to work, and it's actually quite a complicated option
if you wish to use that.
So Microsoft understood this and realized that for lots of
organizations it was just a no go, and so most of the time,
it was HTTP or WSMan connections.
Now, of course, what Microsoft also realized is that not every environment runs
just Windows. Maybe you're one of those environments where you run Linux or
other applications that are not Microsoft Windows.
So SSH has been available since PowerShell Core version 6 or
higher, and this allows cross‑platform connecting, but it can
also work within Windows as well.
So if you don't want to use HTTP or HTTPS,
you can actually allow remote connections to Windows and Linux over
SSH. And so we'll talk about both of these options,
the HTTP WSMan version and the SSH, and we'll kind of walk
through the process of how we enable that.
So let's first look at how we enable PowerShell Remoting for WSMan.
Now we have two core options that we can utilize when using
PowerShell. Now the first one is to use a command called
Set‑WSManQuickConfig. By the way,
I love commands like this that basically tell me exactly what it's going to do,
and I don't have to do anything. I can literally execute that command, and it
will enable effectively the Windows 10 default. If I wanted to make it a bit
more secure and use SSL, isn't that amazing?
I can literally just put a parameter called ‑UseSSL,
and it will do the same thing.
Now,
the other option that we've got is to use a different command that's
available called Enable‑PSRemoting, and I can do ‑Force to make sure that
goes in. And this is one of the most common.
So for example,
if I was showing you on a Windows 10 machine that I was using
locally I wanted to enable PS Remoting,
I could just run that command. And, of course, one of the
issues that we sometimes get is that depending on how the
network is defined within Windows, whether it's private,
public, etc., we can sometimes have an issue.
So, luckily for us, we have another property called SkipNetworkProfileCheck
that will actually bypass that and then enable PS Remoting.
Now you will need to say yes or no, depending on the
configuration that you wish to go with.
So two kind of core options, one that's going to do the quick
config for you, and it's fairly out of the box.
The other one allows a little bit more flexibility.
Now, of course, if you're not an administrator on the
device, then of course, you can't execute some of these
commands because they make core changes.
So, for those non administrators,
one of the options that we do have is to use a security group.
So we can first define an Active Directory security group,
maybe call it remote users, and then we simply add that security group to the
Remote Management Users group that's local to the computer.
So if we want to say Liam is on his laptop and he doesn't have admin access,
we can grant him access to that one and then to the other
device that he needs to connect to.
Now the other option that we've got is what about if we want
to, as part of our Globomantics management,
we want to be able to remote into multiple machines at the same time.
Now, of course, let's go back to our idea of our server farm having 100 servers.
Now I don't really want to go to every single server and basically run
the PowerShell that says enable PS Remoting, which I have seen people do,
so there has to be a faster and easier way.
Well, sure enough, there is. We can actually utilize Group Policy.
Now what Group Policy does is it basically represents the configuration
changes that the PowerShell would make if we executed it,
but does it as part of a Group Policy.
So to do that,
we open the Group Policy Management tool. We make sure we go to the
Computer Configuration option. We're going to navigate through to the
Windows Remote Management, or the WinRM settings, and then we basically
allow the option for the WinRM service to be enabled, and set up, and
configured. And so it's a fairly painless process, but what's nice about
this is that we make a Group Policy change, all of the servers auto
refresh,
get the new Group Policy, and then the service becomes available
and ready for us to do PowerShell Remoting.
So let's say that we don't want to use WSMan or maybe we have Linux servers
that we wish to utilize, so we can utilize the SSH option instead. Now, of
course, Windows does support that as well.
So in order for us to use it in Windows,
we first install the latest version of Powershell, so PowerShell 7 and upwards.
We'll then install the latest version of OpenSSH. Once that's installed,
we'll then define the SSH configuration, so imagine like a config file
where we can put entries in etc., and then we restart that service to bring
it back up with the new configuration.
Now to do this, we would need to prepare the Windows 10 for that one.
So our first installation task is to put OpenSSH.Client and
Server, and this is done by choosing Add‑WindowsCapability
from online and adding those in.
Now once they're in and installed,
the next task is to make sure that the service that we just added,
so the SSH service, starts up automatically.
Otherwise, every time we reboot the server, we can't SSH back to it.
So at this point, we can say set the service to Automatic, and
then start that service. Now, of course,
what's nice here is when Microsoft starts adding features like this,
they also add other things that we can utilize.
So, for example, we can install an import, Microsoft's PowerShell
Remoting Module, which they created for things like this.
So we'll first install the module, and then import the module.
What this allows us to do is then to execute something that looks very similar
to a previous command, which was called Enable‑PSRemoting, but we can say
Enable‑SSHRemoting, and then we can restart the service.
Then at that point, our Windows 10 environment is
then ready for SSH connections.
Now if we're not using Windows 10, and we actually have Linux into the
equation, so something like Ubuntu, then the process is very similar.
We first install the latest version of PowerShell. We then need to
install the latest OpenSSH server,
so a little bit different, but kind of the same idea.
We then define the SSH configuration, and then we restart the SSH service.
So both platforms are effectively the same,
and that's what's nice about PowerShell being cross‑platform and remoting being cross‑platform.