So now that we know how to create credentials,
that's at least given us the authentication to get somewhere,
but that doesn't mean that for example,
I can use my Windows 10 workstation and connect across to a
domain controller using PowerShell remoting. So we need to talk
about something called trusted hosts.
So the first question is, what are the trusted hosts?
Well,
workgroup workstations are allowed to remotely manage
domain joined workstations or service.
Now,
the difficulty is that just because remoting is enabled doesn't necessarily
mean that the workgroup workstation or the non‑domain machine can actually
connect to that domain joined workstation or server.
So a trusted host is an entry that will allow both sides
of the equation to trust each other.
Now for example,
you may be on a different domain joined workstation that wants to remotely
manage something also, so that would need to be a trusted host. Or maybe you're
on a workstation that's allowed to remotely manage,
but I need to use different credentials to be able to come across
versus the credentials that might exist on that machine.
So the trusted hosts are effectively machines that wouldn't
normally be allowed to access or remotely manage the server or the
other workstations on a domain, for example.
So why would we use trusted hosts?
Well firstly,
if the remote system we're trying to get to is not part of the domain,
then of course we need to use trusted hosts to be able to communicate across.
Also, if the remote system is part of an untrusted domain,
so something that we're not sure of,
then of course we'll need to utilize this too.
And then of course, lastly,
if we're connecting to the remote system using local
credentials instead of domain credentials that we would
normally push from one location to another.
So three kind of different reasons of why we should use those trusted hosts.
So what is a trusted host entry and what is it made up of?
Well,
the first thing is it contains an IP Version 4 Address. It could also contain
an IP Version 6 Address, so, we need those kind of entries.
It could also be a fully qualified domain name or a domain
name, or we could be utilizing a wildcard.
So the wildcard is actually quite common, even though it's not the most secure.
Often people will just enable it and say wildcard anybody can connect, but in
a more secure environment we'll obviously need to register the specific IP
addresses or the fully qualified domain name of the host that needs to
connect to the other place. Now to create trusted host entries, what we're
going to do here is we can use what's called winrm as a command. So this is
inside the command prompt itself, so, cmd, you launch that on windows, you
can say winrm, and then you set the trusted host parameter here to, for
example, the IP address of the machine that you're going to be connecting
from.
We can also achieve the same thing by using PowerShell, which does the exact
same process it uses called Set‑Item, and then sets the WSMan property for
trusted hosts to be that specific IP address.
And then of course, we can add trusted host entries just using direct
PowerShell. So instead of creating it we can actually go ahead and
retrieve the values and then add something to it.
So, for example, let's say you have a server that already has trusted host
entries for seven machines, but you need to append another one to it, then we
can do it this way. We can basically retrieve, by using Get‑Item, the list of
trusted host entries already, and then you'll see in the Set‑Item, we're able
to go to Set‑Item ‑Path,
blah, blah, blah, TrustedHosts, and then we can see we have the
variable, comma, and then the new one that we need to add.
So let's talk about Globomantics trusted hosts for a second.
So right now we obviously have some specific pieces.
We have an Active Directory Server,
we have a File Server, and then of course we have an Administration Workspace.
Everything on the left‑hand side there is domain joined.
So we have the Active Directory, the File Server are all connected together,
but on the admin side we are not domain joined.
So in order for the workstation on the right‑hand side there to connect and
remotely manage the Active Directory server or the File Server,
we would need to add trusted host entries, and the trusted
host entry would be something like this.
So, Set‑Item WSMan TrustedHosts, and then you'll see the IP address of the
Administration Workstation. And the trusted host entries would be added to
the Active Directory Server and the File Server, and anything else that existed in that domain joined environment.