Windows Firewall, IPSec, and Remote PowerShell

Question

I've configured Connection Security Rules to require inbound authentication using Kerberos:

I've configured Windows Firewall to block all incoming connections:

And I've configured various exceptions to allow incoming connections for required services from authorized users and computers:

Each of these rules are configured to override the "Block all connections" default firewall setting mentioned earlier:

This all works fine with one exception...I cannot get remote PowerShell commands to work in this configuration:

It seems the RPC Dynamic Ports don't open up on the remote PC when running a PowerShell command like "Get-WMIObject". It doesn't matter what kind of exceptions I put in, it never works. I even created an exception that says "let everything in" from my authorized PCs and it still doesn't work:

Other similar inbound rules work fine (Like the default Remove Event Log Management (RPC) rule, which allows inbound connections for %SystemRoot%\System32\svchost.exe% to RPC Dynamic Ports). Something about remote PowerShell is unique and I can't figure out what, any thoughts from the community?

Answer 1

Hi,

Check that the Windows Management Instrumentation (WMI-In) rule is enabled in the firewall. Otherwise you will see the RPC server is unavailable message, as picture below:

Best Regards,
Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Still having this problem. I'll put it out there a different way...

I've deleted all rules except one "AllowAll" rule for my workstation:

When I try to view remote event viewer logs, everything works as expected:

Windows Firewall Logs confirm the successful connection:

But when I try to use Get-WmiObject in PowerShell, Im able to establish connection on TCP port 135, but the RPC Dynamic Ports are never opened, and the Get-WmiObject command fails:

Windows Firewall Log shows the successful connection to TCP 135, but no log of a dropped connection to the RPC Dynamic Ports:

Remote event log viewer works but Get-WmiObject doesnt. Why?

Answer 3

It looks like a powershell issue
The classic cmd.exe works much better.