Enable and configure Windows PowerShell Remoting using Group Policy

As you may know, Windows PowerShell 2.0 introduced a new remoting feature, allowing for remote management of computers.

While this feature can be enabled manually (or scripted) with the PowerShell 2.0 cmdlet Enable-PSRemoting, I would recommend using Group Policy whenever possible. This guide will show you how this can be accomplished for Windows Vista, Windows Server 2008 and above. For Windows XP and Windows Server 2003, running Enable-PSRemoting in a PowerShell startup script would be the best approach.

Windows PowerShell 2.0 and WinRM 2.0 shipped with Windows 7 and Windows Server 2008 R2. To take advantage of Windows PowerShell Remoting, both of these are required on the downlevel operating systems Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008. Both Windows PowerShell 2.0 and WinRM 2.0 are available for download here, as part of the Windows Management Framework (Windows PowerShell 2.0, WinRM 2.0, and BITS 4.0). To deploy this update to downlevel operating systems I would recommend to use WSUS, which are described in detail in this blog post by Kurt Roggen.

Group Policy Configuration

Open the Group Policy Management Console from a domain-joined Windows 7 or Windows Server 2008 R2 computer.

Create or use an existing Group Policy Object, open it, and navigate to Computer Configuration->Policies->Administrative templates->Windows Components

Here you will find the available Group Policy settings for Windows PowerShell, WinRM and Windows Remote Shell:

image

To enable PowerShell Remoting, the only setting we need to configure are found under “WinRM Service”, named “Allow automatic configuration of listeners”:

image

Enable this policy, and configure the IPv4 and IPv6 addresses to listen on. To configure WinRM to listen on all addresses, simply use *.

In addition, the WinRM service are by default not started on Windows client operating systems. To configure the WinRM service to start automatically, navigate to Computer ConfigurationPoliciesWindows SettingsSecurity SettingsSystem ServicesWindows Remote Management, doubleclick on Windows Remote Management and configure the service startup mode to “Automatic”:



No other settings need to be configured, however, I`ve provided screenshots of the other settings so you can see what`s available:

image

image

image

image

There is one more thing to configure though; the Windows Firewall.

You need to create a new Inbound Rule under Computer Configuration->Policies->Windows Settings->Windows Firewall with Advanced Security->Windows Firewall with Advanced Security->Inbound Rules:

image

The WinRM port numbers are predefined as “Windows Remote Management”:

image

With WinRM 2.0, the default http listener port changed from TCP 80 to TCP 5985. The old port number are a part of the predefined scope for compatibility reasons, and may be excluded if you don`t have any legacy WinRM 1.1 listeners.

image

image

When the rule are created, you may choose to make further restrictions, i.e. to only allow the IP addresses of your management subnet, or perhaps some specific user groups:

image

Now that the firewall rule are configured, we are done with the minimal configuration to enable PowerShell Remoting using Group Policy.

image

On a computer affected by the newly configured Group Policy Object, run gpupdate and see if the settings were applied:

image

As you can see, the listener indicates “Source*”GPO”, meaning it was configured from a Group Policy Object.

When the GPO have been applied to all the affected computers you are ready to test the configuration.

Here is a sample usage of PowerShell Remoting combined with the Active Directory-module for Windows PowerShell:

image

The example are saving all computer objects in the Domain Controller Organization Unit in a variable. Then, a foreach-loop are invoking a scriptblock, returning the status of the Netlogon-service on all of the Domain Controllers.

Summary

We`ve now had a look on how to enable and configure PowerShell Remoting using Group Policy.
There are an incredible number of opportunities opening up with the new Remoting feature in Windows PowerShell 2.0. For a complete walkthrough on how you can use this new feature, I would like to recommend the excellent Administrator’s Guide to Windows PowerShell Remoting written by Dr. Tobias Weltner, Aleksandar Nikolic and Richard Giles.

22 thoughts on “Enable and configure Windows PowerShell Remoting using Group Policy

  1. Pingback: Enable and configure Windows PowerShell Remoting using Group … | Software Firewall

  2. Pingback: Invoke Best Practices Analyzer on remote servers using PowerShell « blog.powershell.no

  3. I’m just trying to do this now… I’m on W7 Enterprise with the RSAT installed and the GPMC enabled and all that jazz…

    I can’t find the Group Policy setting to Enable Scripting for powershell anywhere… Am I just going blind or do I actually have to add in the legacy XP/2003 .adm template to enable it?

  4. Pingback: Powershell Remoting Part 2 « I Think In Code

  5. Hello
    I tested enabling “Allow automatic configuration of listeners” via GPO to enable remote management but it is not enough!

    From Powershell: Get-PSSessionConfiguration

    Name PSVersion StartupScript Permission
    —- ——— ————- ———-
    microsoft.powershell 2.0 Everyone AccessDenied, BUILTINA…
    Microsoft.PowerShell32 2.0 Everyone AccessDenied, BUILTINA…
    microsoft.ServerManager 2.0 Everyone AccessDenied, BUILTINA…

    As you can see, remote management will be enabled but every access will be denied.
    Please, how to make “Set-PSSessionConfiguration” with correct SDDL via GPO without creating powershell startup scripts?
    Is there other possibility how to remove “Everyone AccessDenied” via GPO without manually starting “Enable-PSSessionConfiguration”?

    Many thanks
    ExSport

      • Maybe something changed from SP1 on 2008R2?
        Unfortunatelly when I enable Remote Management by Powershell “Enable-PSSessionConfiguration” or manually by ticking it in GUI, correct descriptor is set.
        But when unticked or “Disable-PSSessionConfiguration” used, it always change SDDL to Everyone Denied so enabling listener via GPO is not enough.
        Many thanks for any hints.

  6. Pingback: Enable WinRM with Group Policy, but use PowerShell to Create the Policy « Tome's Land of IT

  7. Pingback: Installing Roles and Features remotely on multiple computers simultaneously « JasonHelmick

  8. Pingback: Enabling PowerShell Remoting in your Environment « JasonHelmick

  9. Pingback: Introducing the PowerShell Network Adapter Configuration module « blog.powershell.no

  10. Pingback: Introducing the PowerShell Network Adapter Configuration module - Jan Egil`s blog on Microsoft Infrastructure

  11. Pingback: I have better things to do than deploy IIS. Also I’m lazy. « IISonThe.net

  12. Pingback: PowerShell Remoting Configuration Proposal | Other Duties As Required

  13. Pingback: Powershell: Install role or feature on multiple remote servers | cloud.kemta.net

  14. Pingback: Configuring PowerShell Remoting with Group Policy - SQL Server - SQL Server - Toad World