[Console]::OutputEncoding = [Text.Encoding]::UTF8
$ErrorActionPreference = 'SilentlyContinue'

function Section($title) {
    Write-Host ''
    Write-Host ('=' * 8) $title ('=' * 8) -ForegroundColor Green
}

Section "WinRM Network Diagnostics"

# Check if WinRM is running
$winrmService = Get-Service WinRM
Write-Host "WinRM Service Status: $($winrmService.Status)" -ForegroundColor $(if($winrmService.Status -eq 'Running') {'Green'} else {'Red'})

# Check WinRM listeners
Section "WinRM Listeners"
try {
    $listeners = winrm enumerate winrm/config/listener
    Write-Host $listeners
} catch {
    Write-Host "Failed to enumerate listeners: $_" -ForegroundColor Red
}

# Check firewall rules specifically for WinRM
Section "Firewall Rules for WinRM"
$winrmRules = Get-NetFirewallRule | Where-Object { $_.DisplayName -like "*WinRM*" -or $_.DisplayName -like "*Windows Remote Management*" }
foreach ($rule in $winrmRules) {
    $ruleDetails = Get-NetFirewallPortFilter -AssociatedNetFirewallRule $rule -ErrorAction SilentlyContinue
    $color = if ($rule.Enabled) { 'Green' } else { 'Red' }
    Write-Host "$($rule.DisplayName): $($rule.Enabled) [$($rule.Direction)] Port: $($ruleDetails.LocalPort)" -ForegroundColor $color
}

# Check network connections on port 5985
Section "Network Connections on Port 5985"
$connections = Get-NetTCPConnection -LocalPort 5985 -ErrorAction SilentlyContinue
if ($connections) {
    $connections | Select-Object LocalAddress, LocalPort, State, OwningProcess | Format-Table -AutoSize
} else {
    Write-Host "No connections found on port 5985" -ForegroundColor Red
}

# Check listening ports
Section "Listening Ports (including 5985)"
Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -in @(22, 5985, 5986) } |
    Select-Object LocalAddress, LocalPort, State, OwningProcess | Format-Table -AutoSize

# Get detailed WinRM configuration
Section "Detailed WinRM Configuration"
try {
    Write-Host "Service Configuration:" -ForegroundColor Yellow
    winrm get winrm/config/service

    Write-Host "`nListener Configuration:" -ForegroundColor Yellow
    winrm get winrm/config/listener?Address=*+Transport=HTTP

} catch {
    Write-Host "Failed to get WinRM config: $_" -ForegroundColor Red
}

# Test local WinRM connection
Section "Local WinRM Connection Test"
try {
    $testResult = Test-WSMan -ComputerName localhost -ErrorAction Stop
    Write-Host "✅ Local WinRM test successful" -ForegroundColor Green
} catch {
    Write-Host "❌ Local WinRM test failed: $_" -ForegroundColor Red
}

# Network interface information
Section "Network Interfaces"
Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.InterfaceAlias -notmatch 'Loopback' } |
    Select-Object InterfaceAlias, IPAddress, PrefixLength | Format-Table -AutoSize

# Proposed fixes
Section "Recommended Fixes"
Write-Host "1. Enable WinRM firewall rules:" -ForegroundColor Yellow
Write-Host "   Enable-NetFirewallRule -DisplayName 'Windows Remote Management (HTTP-In)'" -ForegroundColor White

Write-Host "`n2. Set AllowUnencrypted to true:" -ForegroundColor Yellow
Write-Host "   winrm set winrm/config/service '@{AllowUnencrypted=`"true`"}'" -ForegroundColor White

Write-Host "`n3. Ensure listener is on all interfaces:" -ForegroundColor Yellow
Write-Host "   winrm set winrm/config/listener?Address=*+Transport=HTTP '@{Enabled=`"true`"}'" -ForegroundColor White

Write-Host "`n4. Test from remote after fixes:" -ForegroundColor Yellow
Write-Host "   Test-WSMan -ComputerName 192.168.88.108 -UseSSL:`$false" -ForegroundColor White