Hey there, fellow threat hunters! 👋 Today we're diving into PowerShell remote management. Whether you're managing a fleet of servers or investigating a suspicious endpoint, knowing how to work remotely is essential. Let's get started!

Check Remote Access

First, let's see if we can even connect remotely:

# Test WinRM connectivity
Test-WSMan -ComputerName "remote-pc.domain.name"

# Check if PowerShell remoting is enabled
$computerName = "remote-pc.domain.name"
Test-NetConnection -ComputerName $computerName -Port 5985 # HTTP
Test-NetConnection -ComputerName $computerName -Port 5986 # HTTPS

Starting a Remote Session

There are several ways to work remotely. Here are the most common:

# Method 1: One-off command
Invoke-Command -ComputerName "remote-pc" -ScriptBlock {
    Get-Service | Where-Object Status -eq "Running"
}

# Method 2: Interactive session
Enter-PSSession -ComputerName "remote-pc"

# Method 3: Multiple computers at once
$computers = "server1", "server2", "server3"
Invoke-Command -ComputerName $computers -ScriptBlock {
    Get-Process | Select-Object Name, CPU, PM
}

Working with Credentials

Sometimes you need different credentials:

# Store credentials securely
$cred = Get-Credential

# Use stored credentials
Enter-PSSession -ComputerName "remote-pc" -Credential $cred

# For multiple machines
Invoke-Command -ComputerName $computers -Credential $cred -ScriptBlock {
    Get-WinEvent -LogName Security -MaxEvents 10
}

Understanding the Protocols

PowerShell remoting isn't magic - it relies on specific protocols:

• WS-Management (WinRM): The core protocol that handles the remote connections
  • Uses HTTP (5985) or HTTPS (5986)
  • Handles authentication and encryption
  • Built on SOAP (Simple Object Access Protocol)
• Kerberos/NTLM: For authentication
  • Kerberos is used in domain environments
  • NTLM is the fallback for workgroup scenarios

There's also legacy protocols that you might encounter:

• DCOM (Distributed COM): Older method, still used by some cmdlets
  • Uses RPC (TCP 135)
  • Less secure than WinRM
  • Still used by Get-WmiObject (but not by Get-CimInstance)

# Check which protocol you're using
Get-CimInstance -ComputerName "remote-pc" Win32_OperatingSystem # Uses WinRM
Get-WmiObject -ComputerName "remote-pc" Win32_OperatingSystem  # Uses DCOM

File Operations

Need to copy files? Here's how:

# Copy a file to remote machine
Copy-Item -Path "C:\Scripts\test.ps1" `
    -Destination "C:\Scripts\" `
    -ToSession (New-PSSession -ComputerName "remote-pc")

# Copy from remote machine
Copy-Item -Path "C:\Logs\error.log" `
    -Destination "C:\LocalLogs\" `
    -FromSession (New-PSSession -ComputerName "remote-pc")

Session Management

Keep your sessions under control:

# Create a persistent session
$session = New-PSSession -ComputerName "remote-pc"

# Use the session multiple times
Invoke-Command -Session $session -ScriptBlock {
    Get-Process
}

# Clean up when done
Remove-PSSession -Session $session

# List all active sessions
Get-PSSession

Common Issues and Solutions

# Enable PowerShell remoting (run as admin on remote PC)
Enable-PSRemoting -Force

# Add host to trusted list (if not in domain)
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "remote-pc" -Force

# Increase timeout for long-running commands
$session = New-PSSession -ComputerName "remote-pc" -MaxConnectionRetryCount 5

Pro Tips

• Use session splat: Create a hashtable for session parameters you use often
• Clean up sessions: Always remove sessions when done to free up resources
• Mind the scope: Variables in remote sessions are isolated by default
• Consider security: HTTPS (5986) is more secure than HTTP (5985)

Security Considerations

# Check current WinRM security configuration
winrm get winrm/config/client
winrm get winrm/config/service

# Configure HTTPS listener (more secure)
New-SelfSignedCertificate -DnsName "domain.name" `
    -CertStoreLocation "Cert:\LocalMachine\My"
    
# Configure HTTPS WinRM listener (run as admin)
winrm create winrm/config/Listener?Address=*+Transport=HTTPS...

Wrapping Up

Remote management is powerful but requires careful attention to security. Always use the principle of least privilege and clean up your sessions!

Stay safe, and happy hunting! 🕵️‍♂️

P.S. Check out the official documentation for more details:

• PowerShell Remoting Documentation
• Remoting Troubleshooting Guide
• WS-Management Documentation