PowerShell Remote Management Tools
In this issue:
Overview
In this issue we'll explore ways to use PowerShell to manage traditional PowerShell remoting. We'll look at ways to take advantage of Connect-WSManInstance, Get-WSManInstance, and Set-WSManInstance.
Introduction
Since we started down the rabbit hole that is PowerShell remoting, I figured we might as well keep going. I am assuming that many people are still using traditional PowerShell remoting using the WSMan protocol and might appreciate tips and tooling to better manage it. Today's content is all about WSMan connection tips and tricks. I might cover PowerShell remoting over ssh another day.
My context is that you want to manage PowerShell remoting from your administrator desktop. You can use Windows PowerShell or PowerShell 7 but we'll only be looking at WSMan-based remoting. I'm also assuming you have administrator privileges or credentials for any computer you want to remotely manage. I'm also assuming you've configured TrustedHosts as necessary.
WSManProvHost
Let's start with an easy trick. When a remote PowerShell session is running, you will see a wsmanprovhost process. Using Get-Process you can discover the user running the process.
PS C:\> Invoke-Command { Get-Process wsmprovhost -IncludeUserName } -computername srv1
Handles WS(K) CPU(s) Id UserName ProcessName PSComputerName
------- ----- ------ -- -------- ----------- --------------
592 61660 0.23 340 COMPANY\ArtD wsmprovhost srv1
479 61388 0.23 2404 COMPANY\ArtD wsmprovhost srv1
> I'm using code that will work in Windows PowerShell and PowerShell 7.
There are two processes because running invoke-command creates another WSMan connection which means another instance of the process. The easy solution is to filter out the newest process.
PS C:\> Invoke-Command { Get-Process wsmprovhost -IncludeUserName | Sort-Object StartTime -descending | Select-Object -Skip 1 } -Computername srv1 | Select-Object ID,Username,StartTime,@{Name="Runtime";Expression = { New-TimeSpan -start $_.StartTime
-end (Get-Date)}},@{Name="Computername";Expression = {$_.PSComputername.ToUpper()}}
Id : 2404
UserName : COMPANY\ArtD
StartTime : 10/22/2026 10:46:19 AM
Runtime : 02:00:03.5522900
Computername : SRV1
It wouldn't take much to turn this expression into a PowerShell function. I'll leave that to you.
Connect-WSMan
Another tool at your disposal is Connect-WSMan. This creates a connection to the WSMan endpoint on a remote computer, but does not establish a traditional remoting session.
PS C:\> Connect-wsman -ComputerName win10
If I look at process on WIN10, I won't see a wsmanprovhost instance. But I am connected. Just not in the way you might expect.
To use the connection, change to the WSMan PSDrive.
PS C:\> cd WsMan:
PS WSMan:\> dir
WSManConfig:
ComputerName Type
------------ ----
win10 Container
localhost Container
In essence, I can now navigate the WSMan PSDrive on WIN10.
PS WSMan:\> cd .\win10\
PS WSMan:\win10> dir .\Client\
WSManConfig: Microsoft.WSMan.Management\WSMan::win10\Client
Type Name SourceOfValue Value
---- ---- ------------- -----
System.String NetworkDelayms 5000
System.String URLPrefix wsman
System.String AllowUnencrypted false
Container Auth
Container DefaultPorts
System.String TrustedHosts srv3
Remote Trusted Hosts
I can easily see the TrustedHosts setting on the remote computer. I can even change it.
PS WSMan:\win10> Set-Item .\Client\TrustedHosts -Value "srv4" -Concatenate -Force
PS WSMan:\win10> Get-Item .\Client\TrustedHosts
WSManConfig: Microsoft.WSMan.Management\WSMan::win10\Client
Type Name SourceOfValue Value
---- ---- ------------- -----
System.String TrustedHosts srv3,srv4
Can you envision how you could turn this into a reporting function?
