155 lines
6.0 KiB
PowerShell
155 lines
6.0 KiB
PowerShell
[Console]::OutputEncoding = [Text.Encoding]::UTF8
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
function Section($title) {
|
|
Write-Host ''
|
|
Write-Host ('=' * 8) $title ('=' * 8) -ForegroundColor Green
|
|
}
|
|
|
|
function StatusUpdate($message) {
|
|
Write-Host "✅ $message" -ForegroundColor Green
|
|
}
|
|
|
|
function WarningUpdate($message) {
|
|
Write-Host "⚠️ $message" -ForegroundColor Yellow
|
|
}
|
|
|
|
Write-Host "Starting WinRM Configuration..." -ForegroundColor Cyan
|
|
Write-Host "This script will configure WinRM for remote management." -ForegroundColor Cyan
|
|
Write-Host ""
|
|
|
|
# Check if running as Administrator
|
|
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
|
|
$isAdmin = $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
|
|
|
|
if (-not $isAdmin) {
|
|
Write-Host "❌ ERROR: This script must be run as Administrator" -ForegroundColor Red
|
|
Write-Host "Please run PowerShell as Administrator and try again." -ForegroundColor Red
|
|
exit 1
|
|
}
|
|
|
|
StatusUpdate "Running as Administrator"
|
|
|
|
Section "Enable PowerShell Remoting"
|
|
try {
|
|
Enable-PSRemoting -Force -SkipNetworkProfileCheck | Out-Null
|
|
StatusUpdate "PowerShell Remoting enabled"
|
|
} catch {
|
|
WarningUpdate "PowerShell Remoting may already be enabled: $($_.Exception.Message)"
|
|
}
|
|
|
|
Section "Configure WinRM Service"
|
|
try {
|
|
# Ensure WinRM service is set to automatic startup
|
|
Set-Service -Name WinRM -StartupType Automatic
|
|
Start-Service -Name WinRM
|
|
StatusUpdate "WinRM service configured and started"
|
|
} catch {
|
|
WarningUpdate "WinRM service configuration: $($_.Exception.Message)"
|
|
}
|
|
|
|
Section "Run WinRM Quick Configuration"
|
|
try {
|
|
$quickConfigOutput = cmd /c "winrm quickconfig -quiet" 2>&1
|
|
StatusUpdate "WinRM quick configuration completed"
|
|
} catch {
|
|
WarningUpdate "WinRM quickconfig: $($_.Exception.Message)"
|
|
}
|
|
|
|
Section "Configure Authentication Methods"
|
|
try {
|
|
# Enable Basic authentication for simplicity (can be disabled later for production)
|
|
cmd /c 'winrm set winrm/config/service/auth @{Basic="true"}' | Out-Null
|
|
StatusUpdate "Basic authentication enabled"
|
|
|
|
# Allow unencrypted traffic for HTTP (can be disabled in production)
|
|
cmd /c 'winrm set winrm/config/service @{AllowUnencrypted="true"}' | Out-Null
|
|
StatusUpdate "Unencrypted communication allowed (for HTTP testing)"
|
|
|
|
} catch {
|
|
WarningUpdate "Authentication configuration: $($_.Exception.Message)"
|
|
}
|
|
|
|
Section "Configure Firewall Rules"
|
|
try {
|
|
# Enable Windows Remote Management firewall rules
|
|
Enable-NetFirewallRule -DisplayGroup "Windows Remote Management" -ErrorAction SilentlyContinue
|
|
StatusUpdate "Windows Remote Management firewall rules enabled"
|
|
} catch {
|
|
WarningUpdate "Firewall configuration: $($_.Exception.Message)"
|
|
}
|
|
|
|
Section "Create HTTP Listener (if needed)"
|
|
try {
|
|
# Check if HTTP listener exists
|
|
$httpListener = winrm enumerate winrm/config/listener | Select-String "Transport = HTTP"
|
|
if (-not $httpListener) {
|
|
winrm create winrm/config/listener?Address=*+Transport=HTTP | Out-Null
|
|
StatusUpdate "HTTP listener created on port 5985"
|
|
} else {
|
|
StatusUpdate "HTTP listener already exists"
|
|
}
|
|
} catch {
|
|
WarningUpdate "HTTP listener configuration: $($_.Exception.Message)"
|
|
}
|
|
|
|
Section "Test Local Connection"
|
|
try {
|
|
$testSession = New-PSSession -ComputerName localhost -ErrorAction Stop
|
|
Remove-PSSession $testSession -ErrorAction SilentlyContinue
|
|
StatusUpdate "Local WinRM connection test successful"
|
|
} catch {
|
|
WarningUpdate "Local connection test failed: $($_.Exception.Message)"
|
|
Write-Host " This may be normal if additional configuration is needed"
|
|
}
|
|
|
|
Section "Configuration Summary"
|
|
Write-Host ""
|
|
Write-Host "WinRM has been configured with the following settings:" -ForegroundColor Cyan
|
|
Write-Host ""
|
|
|
|
# Display current configuration
|
|
try {
|
|
Write-Host "Service Status:" -ForegroundColor Yellow
|
|
Get-Service WinRM | Select-Object Name, Status, StartType | Format-List
|
|
|
|
Write-Host "Listeners:" -ForegroundColor Yellow
|
|
winrm enumerate winrm/config/listener
|
|
|
|
Write-Host "Authentication Methods:" -ForegroundColor Yellow
|
|
winrm get winrm/config/service/auth
|
|
|
|
Write-Host "Firewall Rules:" -ForegroundColor Yellow
|
|
Get-NetFirewallRule -DisplayGroup "*Remote Management*" | Where-Object Enabled -eq $true |
|
|
Select-Object DisplayName, Direction, Action | Format-Table -AutoSize
|
|
|
|
} catch {
|
|
Write-Host "Could not retrieve full configuration details"
|
|
}
|
|
|
|
Section "Connection Information"
|
|
$ipAddresses = Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.InterfaceAlias -notmatch 'Loopback' } | Select-Object -ExpandProperty IPAddress
|
|
$computerName = $env:COMPUTERNAME
|
|
|
|
Write-Host "Computer Name: $computerName" -ForegroundColor Cyan
|
|
Write-Host "IP Addresses: $($ipAddresses -join ', ')" -ForegroundColor Cyan
|
|
Write-Host ""
|
|
Write-Host "To test from a remote machine, use:" -ForegroundColor Yellow
|
|
Write-Host "Test-WSMan -ComputerName $($ipAddresses[0])" -ForegroundColor White
|
|
Write-Host " or"
|
|
Write-Host "Test-WSMan -ComputerName $computerName" -ForegroundColor White
|
|
Write-Host ""
|
|
Write-Host "For PowerShell remoting:" -ForegroundColor Yellow
|
|
Write-Host "`$session = New-PSSession -ComputerName $($ipAddresses[0]) -Credential (Get-Credential)" -ForegroundColor White
|
|
|
|
Section "Security Notes"
|
|
Write-Host "⚠️ SECURITY CONSIDERATIONS:" -ForegroundColor Yellow
|
|
Write-Host ""
|
|
Write-Host "1. Basic authentication and unencrypted communication are enabled for testing" -ForegroundColor Yellow
|
|
Write-Host "2. For production use, consider:" -ForegroundColor Yellow
|
|
Write-Host " - Disabling Basic auth: winrm set winrm/config/service/auth @{Basic=`"false`"}" -ForegroundColor White
|
|
Write-Host " - Disabling unencrypted: winrm set winrm/config/service @{AllowUnencrypted=`"false`"}" -ForegroundColor White
|
|
Write-Host " - Setting up HTTPS listener with proper certificates" -ForegroundColor White
|
|
Write-Host " - Using Kerberos authentication in domain environments" -ForegroundColor White
|
|
Write-Host ""
|
|
Write-Host "🎉 WinRM configuration completed!" -ForegroundColor Green |