WinRM

WinRM, or Windows Remote Management, is Microsoft's implementation of the WS-Management protocol, a standardized web services-based interface for remote management of Windows-based systems and devices that support WS-Management. It enables administrators to perform management tasks remotely, including executing commands, running scripts, and configuring system settings.

WinRM communicates over HTTP or HTTPS using SOAP-based messages transported by the WS-Management protocol. Server endpoints, called listeners, typically listen on ports 5985 for HTTP and 5986 for HTTPS. Security is provided through mutual authentication and message integrity, with optional encryption when HTTPS is used. Authentication methods commonly include Kerberos, NTLM, and certificate-based schemes, and access is governed by Windows authentication policies and firewall rules.

The architecture centers on the WinRM service, which hosts WS-Management endpoints and handles remote requests. Clients connect to these endpoints using standard WS-Management tooling or through higher-level management tools such as PowerShell remoting. WinRM serves as the foundation for remote administration, including support for Windows PowerShell Remoting, Windows Remote Shell (WinRS), and other WS-Management-compliant clients.

Configuration and usage typically involve enabling and configuring the WinRM service and listeners, often with commands such as winrm quickconfig to set up the service and firewall rules. PowerShell remoting is a common management approach, using commands like Enter-PSSession, Invoke-Command, or New-PSSession to run commands on remote machines. Administrators can restrict remote access using trusted hosts, certificate-based endpoints, and policy-based controls to enforce security and compliance.