So let's go back into our environment.
We'll first look at how we connect to a remote system without using a
trusted host entry and what that looks like and what happens if it's not
trusted, we'll then add a trusted host entry,
and then we'll reconnect it back to the system now that
that trusted host entry has been added.
So we're on the Windows 10 client machine,
and this machine, if I just click the Start menu here and just type advanced,
what I can then do is click View advanced system settings,
click on Computer Name,
and you'll then be able to see that it says computer name
TRAININGWIN10VM and then WORKGROUP, so it's not on a domain of any description.
So I'm going to click Cancel here.
Now,
the goal here is to use this non‑domain joined machine to
remotely administer a domain machine.
In this case, it'll be the Active Directory server.
Now to initiate a PowerShell session, we're going to use Enter‑PSSession,
and then we'll pass the ComputerName, and we'll use the
IP address of the domain controller, so 10.0.0.5,
and we'll just press Enter.
Now of course, it fails instantly because it has no way of authenticating.
It gives us a message about the WINRM client can't process it.
It talks about a different authentication scheme.
So how do we get this process to work?
Well, first off, this is where we talk about the trusted hosts,
and we'll need to make a change in the trusted hosts
on the Active Directory server.
So we'll just flick across now to the Active Directory
server and make this adjustment.
So here we are on the domain controller.
Now we need to set the trusted host value on this machine to
allow the non‑domain machine to communicate.
Now I'm using PowerShell to do this,
so we can actually use a command called Set‑Item.
But before we do that, it's always good to check what the value is going to be.
So I'm going to say Get‑Item,
and the syntax we use is using a protocol called WSMan,
and then I'm going to type localhost, which is this machine,
\Client\TrustedHosts, and then I can press Enter.
Now you'll see it goes and queries inside the machine in the
WSMan protocol and comes back and says, okay, I've got that property,
but I don't have any value associated to that one.
So, the first thing we have to do here is to set that to the value that we need.
So I'm going to say Set‑Item, we'll go back and use that same string value,
so WSMan:\localhost\Client\TrustedHosts.
Then we'll set the property of ‑Value to be the IP address of our machine,
which is 10.0.0.8, and then I'm going to use the word ‑Force to force that in,
and we'll press that.
We'll then just go up and choose the Get option to make
sure that we now have a value that's set.
Now,
we can use a specific IP address here to say this is the IP
addresses that I wish to allow to come in.
So for example,
if we were using the 10 range, I could put the IP
address of whatever the machines would be,
or I could use a different approach, which I'm going to do here,
and I'm going to get rid of my IP addresses and just use an asterisk, or a star,
press Enter, and then I'll choose the Get,
and you'll see the Value is now set to the *,
which means any IP address can communicate.
So depending on how secure you would like to be in your environment,
you can determine whether it needs to be IP address
specific or whether we use a star.
For the purposes of this, I'll just use a star for now.
So let's go back to our Windows 10 machine, and
we'll reinitiate that connection.
Okay, so we're back on the Windows 10,
so let's go back and initialize that session again.
So we've added 10.0.0.8, or the asterisk sign,
which basically allows any IP address to connect,
so in theory this should connect.
So I'm going to press Enter.
Now notice what happens.
It fails again.
So there must be another thing that needs to be done.
And sure enough, there is.
So I'm going to clear this screen, and what we'll do is we'll run Get‑Item,
like we did on the previous machine, and I'll say localhost\Client\TrustedHosts,
and we'll see what value.
And see we have no value here.
Now you may be wondering why we have to set a value on this side too.
So the key is if we're utilizing this type of approach using trusted hosts,
we do need to enter values in both sides.
Now for ease and convenience of this,
I'm actually just going to use the asterisk sign,
so I'm going to say Set‑Item WSMan,
so reissue the same command that we just added on the AD server,
except the IP address is obviously not going to be itself.
So TrustedHosts ‑Value "10.0.0.5", which is the AD server,
and then we'll say ‑Force.
So think how that works.
We've got 10.0.0.8 on the one side and 10.0.0.5 on the other one.
Now of course, I'm not going to set it as 5,
I just want to put it as a star because once we put specific IP addresses in,
then any machines that don't have those IP addresses struggle to then
connect because they're not listed as trusted hosts.
So I'm going to set this value here, I'm then going to choose Get,
and sure enough, I now have a value.
So let me clear this here and just loop through my session values here,
and I'm going to say Enter‑PSSession ‑ComputerName,
and sure enough, it now works.
So now that we have the entry for the trusted hosts in both locations,
they are able to communicate.
Now we could have used the IP addresses to make it more
restrictive, or we can use the star.
I'm just going to exit here, and that will take me back out.
But you can see in the console here that the PowerShell command when it's
connected to the remote server or machine is prefixed with the IP address
or the name of the machine that's there.
Now what about if you did want to use IP addresses?
Now what we can do is we can create a variable,
and what I'm going to do here is say Get‑Item,
we're going to use the same kind of syntax that we did before,
so WSMan:\localhost\Client\TrustedHosts),
and then I'll just say .Value, like so.
I can then double‑check what's in that one.
I used host.
Just be careful of the names of variables.
Host is a standard variable. Hosts is the one I created.
And you can see it shows me an asterisk, or a star,
so I'm going to clear that down.
What I can then do is if I wanted to append a value to it,
so let's say I didn't have the star, I had the specific IP address,
so what we'll do is I can say Set‑Item
WSMan:\localhost\Client\TrustedHosts ‑Value.
Now let's say that we did add the domain and we weren't using the star,
I could do this.
And then if I get my Get command here, if we just loop through,
you can see it's now set to an IP address.
Let's say I wanted to allow the AD server to communicate,
but I also wanted the file server and any other IP addresses.
What we're able to do is once we've got those values,
if we go back to my variable here, which is get the value,
$hosts, you'll see it's now got 10.0.0.5.
If I want to add another IP address to that one,
I can say Set‑Item, set the path, or just actually type WSMan,
it doesn't really make a difference in the syntax here,
localhost\Client\TrustedHosts.
What I can then do is use that variable that we have
and then say 10.0.0.10, for example.
So I'm appending to the existing one that's there.
So I'm going to press Enter.
Now, what does that look like?
Well, let's just loop through my commands for a second, and
you'll see we've now got 10.0.0.5 and 10.0.0.10.
So we can create a comma‑separated list and just retrieve
the current value and append to it.
So that's how we can create a connection from a non‑domain machine to
a domain joined machine simply by adding in those trusted host entries into both sides of the environment.