Enable WinRM on Windows Server

ITVA collects data from Windows Server with Remote PowerShell (WinRM). In this guide, you turn on WinRM, add an HTTPS listener, and connect the server to ITVA.

Before you begin

• You can sign in to the server as an administrator.
• You run the commands in this guide in PowerShell, opened with Run as administrator.
• The probe host can reach the server on port 5986 (HTTPS). If you use HTTP, the probe host must reach port 5985.

How ITVA connects

The probe signs in to WinRM with NTLM, using the username and password of the device's credential. You do not need to turn on Basic authentication or allow unencrypted traffic.

• On port 5986, the probe uses HTTPS. The probe does not check the certificate, so a self-signed certificate works.
• On any other port, the probe uses HTTP and encrypts the session with NTLM.

We recommend HTTPS on port 5986.

Check whether WinRM is on

1. Run this command. If WinRM is on, the command shows the WS-Management protocol version.

Test-WSMan

2. List the WinRM listeners. Look for a listener with Transport = HTTPS and Port = 5986.

winrm enumerate winrm/config/listener

If an HTTPS listener already exists, go to Set up the device in ITVA.

Turn on WinRM

1. Run this command. It starts the WinRM service, adds an HTTP listener on port 5985, and adds a firewall rule for it.

Enable-PSRemoting -Force

Add an HTTPS listener

1. Create a self-signed certificate. Replace <HOSTNAME> with the server's host name.

$cert = New-SelfSignedCertificate -DnsName "<HOSTNAME>" -CertStoreLocation Cert:\LocalMachine\My

2. Add an HTTPS listener that uses the certificate.

New-Item -Path WSMan:\localhost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $cert.Thumbprint -Force

3. Allow port 5986 in Windows Firewall.

New-NetFirewallRule -DisplayName "WinRM HTTPS" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow

4. List the listeners again. Make sure that a listener with Transport = HTTPS shows.

winrm enumerate winrm/config/listener

If your organization has its own certificate authority, you can use a certificate from it instead. Use its thumbprint in step 2.

Set up the device in ITVA

1. In the portal, add the server as a device, or open it and select Edit.
2. In Vendor, select Windows Server.
3. In Management Port, enter 5986.
4. In Credentials, add a credential with the Username and Password of an account that can sign in to the server.
5. Select Save.

Check that it worked

1. On the device page, open the actions menu and select Test Connection.
2. Make sure the test succeeds.
3. Select Sync Data, then select Sync. Make sure the log shows sync succeeded lines.

Troubleshooting

If Enable-PSRemoting fails with an error about a Public network, the server has a network connection set to Public. Run the command again with -SkipNetworkProfileCheck, or change the connection to Private or Domain.

Enable-PSRemoting -Force -SkipNetworkProfileCheck

If the connection times out, the probe host cannot reach the port. Make sure the firewall rule exists, and that no network firewall blocks port 5986.

If the sign-in fails with a local account that is not the built-in Administrator, Windows UAC can block the remote session. Use a domain account, or ask your security team before you change the LocalAccountTokenFilterPolicy setting.

If port 5985 works but port 5986 does not, the HTTPS listener is missing. Do the steps in Add an HTTPS listener again.