DSC使用https的winrm

Windows Remote Management provides the transport used by PowerShell remoting. PowerShell Desired State Configuration can keep the service enabled and prevent a manual change from leaving a managed host unreachable.

The examples below use operator, winrm-01.example.test, and addresses reserved for documentation. They do not represent a live host.

Declare the service state

Create WinRMService.ps1:

Configuration WinRMService {
  Import-DscResource -ModuleName PSDesiredStateConfiguration

  Node localhost {
    Service WinRM {
      Name        = 'WinRM'
      State       = 'Running'
      StartupType = 'Automatic'
    }

    Registry DisableUnencryptedWinRM {
      Ensure    = 'Present'
      Key       = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service'
      ValueName = 'AllowUnencrypted'
      ValueType = 'Dword'
      ValueData = 0
      DependsOn = '[Service]WinRM'
    }
  }
}

WinRMService -OutputPath .\WinRMService

Compile and inspect the configuration before applying it:

. .\WinRMService.ps1
Get-Content -Path .\WinRMService\localhost.mof -TotalCount 20
Start-DscConfiguration -Path .\WinRMService -Wait -Verbose
Test-DscConfiguration

The MOF can contain deployment details. Store it as a protected build artifact and do not commit generated MOF files.

Use an HTTPS listener

The service state alone does not create or manage a certificate. Configure an HTTPS listener with a certificate issued for winrm-01.example.test, then make sure the client trusts its issuing certificate authority. Avoid enabling unencrypted transport or skipping certificate checks.

Prompt for credentials rather than embedding them:

$ComputerName = 'winrm-01.example.test'
$Credential = Get-Credential -UserName 'operator'

Test-WSMan -ComputerName $ComputerName -UseSSL
Invoke-Command -ComputerName $ComputerName -UseSSL -Credential $Credential -ScriptBlock {
  $env:COMPUTERNAME
}

Synthetic verification transcript

This transcript shows the useful fields without copying an operational identity or network dump:

PS> whoami
operator

PS> Resolve-DnsName winrm-01.example.test
Name                       Type TTL Section IPAddress
----                       ---- --- ------- ---------
winrm-01.example.test      A    300 Answer  192.0.2.40

PS> Test-NetConnection winrm-01.example.test -Port 5986
ComputerName     : winrm-01.example.test
RemoteAddress    : 192.0.2.40
RemotePort       : 5986
SourceAddress    : 198.51.100.20
TcpTestSucceeded : True

PS> Test-WSMan winrm-01.example.test -UseSSL
wsmid           : http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd
ProtocolVersion : http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd

The transcript omits adapter-specific identifiers and auto-configured local addresses because they are unnecessary for diagnosing the remote service.

Troubleshooting order

1. Confirm that winrm-01.example.test resolves to the expected documentation address.
2. Confirm that TCP port 5986 is reachable.
3. Check that the certificate is valid for the host name and chains to a trusted authority.
4. Confirm that the WinRM service is running and the HTTPS listener exists.
5. Verify authentication and authorization with the least-privileged account required for the task.

Keep command transcripts focused on the failure being investigated. Remove unrelated identity and network details before sharing them in tickets or documentation.