WinRM - Windows Remote Management (Ansible Windows Automation)
Check if WimRM is Running via Powershell (elevated):
in my case the WinRM with HTTP is running.
Remove the existing WinRM Service via Powershell:
dir WSMan:\Localhost\listener | where Keys -eq "Transport=HTTP" | Remove-Item –Recurse
dir WSMan:\Localhost\listener | where Keys -eq "Transport=HTTPS" | Remove-Item –Recurse
Generate a self-signed certificate for the server:
First check the hostname this will be the CN/DNS name for the certificate via Powershell:
Create an certificate for the host via Powershell:
Important, in my LAB setup: Client Windows 10 German with German Time and Server Windows Server 2019 Std. Englisch with UTC time. Caused an problem with using server certificates which were created on the server and were not valid on the Clients until I changed the server time to UTC+01 Berlin.
$Cert = New-SelfSignedCertificate -CertstoreLocation Cert:\LocalMachine\My -DnsName $env:COMPUTERNAME
You can check the certificate was createt by the windows certlm:
Start the WinRM Service with HTTPS and valid certificate via Powershell:
New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Cert.Thumbprint –Force
Check if the service is running:
Adding Firewall input rule to the Windows Firewall (Port 5986):
New-NetFirewallRule -DisplayName "Windows Remote Management (HTTPS-In)" -Name "Windows Remote Management (HTTPS-In)" -Profile Any -LocalPort 5986 -Protocol TCP
Exporting the Certificate for the automation servers:
Export-Certificate -Cert $Cert -FilePath C:\$env:COMPUTERNAME.der
Move the Certificate to your windows client and import it via Powershell (elevated):
Import-Certificate -Filepath "<directory of your cert.der>" -CertStoreLocation "Cert:\LocalMachine\Root"
Test the connection to the server via Powershell:
keep in mind to set the hostname to your hosts of the server is not in your DNS or behind VPN
Enter-PSSession -ComputerName <DNS Hostname> -UseSSL -Credential (Get-Credential)
After Typing in your credentials you have access to the Powershell of the remote server.
You can use this command with credentials in the shell if your security polices allow that the passwords will stay in the history:
winrs -r:https://<DNS Hostname>:5986/wsman -u:<Username> -p:<Password> ipconfig
Proxmox is an Shareware alternative to VMWare what is pretty fast installed on exisiting servers in my case it is an DELL 210ii.
To Create an Bootable stick you have to Select some Optional as exable the DD Mode in Rufus.
In the follwing part you can select the needed DD Mode for the Creating of the USB Stick this is mandatory
Just a hint for all the people who use 2FA and MFA with TOTP via Mobilephone, if you have an Yubikey checkout the yubico-authenticator: Link: https://www.yubico.com/products/yubico-authenticator/