CODEWITHSUNDEEP
powershellwinrm
sanya
sanya

Reputation: 253

Configure and listen successfully using WinRM in powershell

I'm testing WinRM connection using Command Prompt on my local and remote machine and my question is devided into two parts.

PART I

I tested TCP/IP connectivity by using ping command to ping : IP Address of local computer and remote computer, default gateway and DNS Server and it runs perfectly on both local and remote computer.

But when testing using WinRM commands, I used this command to locate listeners and addresses

winrm e winrm/config/listener

It gives me this output for my local machine

Listener
Address = *
Transport = HTTP
Port = 5985
Hostname
Enabled = true
URLPrefix = wsman
CertificateThumbprint
ListeningOn =<IP Address>,127.0.0.1, ::1,fe80::100:7f:fffe%13,fe80::803:5e43:50ef:c50%11

But the same command when I run on remote machine gives me an output with everything else the same, except

Listener[Source="GPO"]
.
.
.
ListeningOn=null

I want to configure it to make it listen correctly.

PART II

And when I run these commands one by one on my remote machine

winrm id -r:<machine name>
winrm get winrm/config -r:<machine name>
winrm get wmicimv2/Win32_Service?Name = WinRM -r:<machine name>

It gives a WSMan Fault with an error message as : 

The client cannot connect to the destination specified in the request. Verify
that the service on the destination is running and is accepting requests.Consult
the logs and documentation for WS-Management service running on the destination,
most commonly IIs or WinRM. If the destination is the WinRM service, run the 
following command on the destination to analyse and configure the WinRM service:
"winrm quickconfig".

Whereas, same commands when I run on my local machine run correctly.

winrm id 
winrm get winrm/config
winrm get wmicimv2/Win32_Service?Name = WinRM

At most, all the problems I'm facing is on my remote machine. What is causing this to happen and how can I configure it to listen and connect successfully? Thank You.

Part II, I am now able to run these on one of my other remote machines with correct output.

I made some changes in this particular remote machine for which I had posted the question and so, it wouldn't run these commands until I fix the part I but besides that if nothing has been altered it will run just like it does on my other remote machines.

I would still appreciate if someone could help me with part I in which I have to get rid of 

Listener[Source=GPO]
..
.
ListeningOn=null

when I run the command 

winrm e winrm/config/listener

because this is what is causing issues but I'm not sure how to disable/remove Group Policy Settings.

Upvotes: 17

Views: 80917

Answers (6)

Oliver
Oliver

Reputation: 21

The thing is that the IP Range you are entering is not the range that has access to the system but defines the IP range that can be used as the WinRM interface by the system. Means you have to specify a range of IP addresses which includes all the client IPs the GPO is affecting.

Upvotes: 2

helviojr
helviojr

Reputation: 31

I solved this changing a GPO, exactly as answered Neossian (sorry, no reputation to just add a comment). But "IPv4 filter" must not be empty, nor accepts CIDR notation (that was my huge mistake). As already said by Craneum, uses "*" for listen on any interface or some range of IP addresses your local network devices are connected (as "192.168.0.1-192.168.0.254" or something like that).

DO NOT USE "192.168.0.0/24" notation. Yes, the help section is very clear on that, yet I used the wrong notation.

Upvotes: 2

ToddJCrane
ToddJCrane

Reputation: 1603

Ensure that you have a filter (IPv4 and/or IPv6) defined in the "Allow remote server management through WinRM" under [Computer Configuration]/[Policies]/[Administrative Templates]/[Windows Components]/[Windows Remote Management (WinRM)]/[WinRM Service].

I would suggest a filter of "*" for both IPv4 and IPv6 unless you know what you want to filter.

Upvotes: 0

kenorb
kenorb

Reputation: 166359

To reset IP addresses (ListeningOn), you probably need to re-create the listener (remove the old HTTP listener and create a new one). Please find the example below.

In PowerShell:

Remove-WSManInstance winrm/config/Listener -SelectorSet @{Address="*";Transport="http"}
New-WSManInstance winrm/config/Listener -SelectorSet @{Address="*";Transport="http"}

Here is the syntax for the specific IP address to bind:

New-WSManInstance winrm/config/Listener -SelectorSet @{Address="IP:192.168.100.2";Transport="http"}

In Command Prompt:

winrm delete winrm/config/Listener?Address=*+Transport=HTTP
winrm create winrm/config/Listener?Address=*+Transport=HTTP

Further reading:

Related question: Allow PowerShell remoting only from one address.

Upvotes: 11

Rutgervonapa
Rutgervonapa

Reputation: 61

I had the same issue and found that when the GPO Setting: Allow remote server management through WinRM had an IPv4 filter set to the IP address of my jumphost the winrm e winrm/config/listener command generated the ListeningOn=null issue.

I solved this by setting the Filter to * and sorting the permissions on firewall level instead.

Upvotes: 6

Neossian
Neossian

Reputation: 705

To determine which group policy is configuring your WinRM you can run the following from an administrative command prompt:

gpresult /h result.html & result.html

In the displayed result, locate Windows Components/Windows Remote Management (WinRM)/WinRM Service. The Winning GPO is where you can enable/disable GPO settings. Use GPMC (Group Policy Management Console) to manage the Group Policy.

ListeningOn=null appears when an administrator has incorrectly configured the Group Policy IPv4 filter setting in Allow automatic configuration of listeners usually with an IP or network that does not exist on the affected Server.

Upvotes: 20

Related Questions