How can I do to enable and disable WinRM (Window Remote Management)

Question

I try enable WinRM with tool psexec: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec

psexec.exe \\Computer-name -s powershell Enable-PSRemoting -Force

And status of service WinRM is running

But I can stop it with:

psexec.exe \Computer-name -s powershell Disable-PSRemoting -Force

Pls, give me some advice to stop it.

Answer 1

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

How do I turn off remote management in WinRM?

Set Microsoft-Windows-Web-Services-for-Management-CoreEnableServerremoteManagement to False to deactivate Server Manager remote management by default on all servers to which you wish to apply the response file. This option prevents remote management throughout the operating system installation procedure.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

Answer 2

Hi,

psexec.exe \Computer-name -s powershell Disable-PSRemoting -Force

psexec \\computerName powershell -Command "Enable-PSRemoting -Force"  
psexec \\computerName powershell -Command "Disable-PSRemoting -Force"

The psexe can be launched with -d option if it are to be launched in the batch processing on the many computers.

Answer 3

Hi,

Yes, after running "Disable-PSRemoting -Force", it is no longer possible to establish remote PowerShell connections.

PS C:\Users\Administrator.AP> Disable-PSRemoting -Force
WARNING: Disabling the session configurations does not undo all the changes made by the Enable-PSRemoting or
Enable-PSSessionConfiguration cmdlet. You might have to manually undo the changes by following these steps:
    1. Stop and disable the WinRM service.
    2. Delete the listener that accepts requests on any IP address.
    3. Disable the firewall exceptions for WS-Management communications.
    4. Restore the value of the LocalAccountTokenFilterPolicy to 0, which restricts remote access to members of the Administrators group on the computer.

The warning messages you see after executing Disable-PSRemoting indicate you should take a few more steps to disable PowerShell remoting. However, these steps only add extra security.

If we want to stop and disable the WinRM service for security reasons, we could use PowerShell:

Stop-Service WinRM -PassThru
Set-Service WinRM -StartupType Disabled -PassThru

The -PassThru parameter lets us see the result of the command.

Answer 4

Oh sorry, I mean stop WinRM service.

So, when I stop PSRemoting, WinRM service is still running.

I used GPO to enable/disable WinRM services.

Thank you for your advice