WS-Management Provider

-------------------------- EXAMPLE 1 --------------------------

Set-Location WSMan:

-------------------------- EXAMPLE 2 --------------------------

Set-Location -Path Localhost

-------------------------- EXAMPLE 3 --------------------------

Set-Location -Path  WSMan:\SERVER01

-------------------------- EXAMPLE 4 --------------------------

Set-Location -Path Localhost\Client

-------------------------- EXAMPLE 1 --------------------------

get-childitem -path WSMan:\Localhost

-------------------------- EXAMPLE 2 --------------------------

get-childitem -path WSMan:\SERVER01

-------------------------- EXAMPLE 3 --------------------------

get-childitem -path WSMan:\

-------------------------- EXAMPLE 4 --------------------------

Get-Childitem

Specifies the address for which this listener was created. The value can be one of the following:

-- The literal string "*". (The wildcard character (*) makes the command bind all the IP addresses on all the network interface cards [NIC].)

-- The literal string "IP:" followed by a valid IP address in either IPv4 dotted-decimal format or in IPv6 cloned-hexadecimal format.

-- The literal string "MAC:" followed by the MAC address of a NIC. For example: MAC:32-a3-58-90-be-cc.

Note: The Address value is set when creating a Listener.

Enables access to remote shells. If you set this parameter to False, new remote shell connections will be rejected by the server. The default is True.

Allows the client computer to request unencrypted traffic. By default, the client computer requires encrypted network traffic.

Specifies the argument string and the command-line arguments that you want to pass to the custom shell. This parameter is optional.

Allows the client computer to use Basic authentication. Basic authentication is a scheme in which the user name and password are sent in clear text to the server or proxy. This method is the least secure method of authentication.

Specifies an operation that is supported on this Uniform Resource Identifier (URI). You have to create one entry for each type of operation that the URI supports. The following are valid values:

-- Create: Create operations are supported on the URI. The SupportFragment attribute is used if the Create operation supports the concept. The SupportFiltering attribute is not valid and should be set to False. This operation is not valid for a URI if Shell operations are also supported.

-- Delete: Delete operations are supported on the URI. The SupportFragment attribute is used if the Delete operation supports the concept. The SupportFiltering attribute is not valid and should be set to False. This operation is not valid for a URI if Shell operations are also supported.

-- Enumerate: Enumerate operations are supported on the URI. The SupportFragment attribute is not supported for Enumerate operations and should be set to False. The SupportFiltering attribute is valid, and if the plug-in supports filtering, this attribute should be set to True. This operation is not valid for a URI if Shell operations are also supported.

-- Get: Get operations are supported on the URI. The SupportFragment attribute is used if the Get operation supports the concept. The SupportFiltering attribute is not valid and should be set to False. This operation is not valid for a URI if Shell operations are also supported.

-- Invoke: Invoke operations are supported on the URI. The SupportFragment attribute is not supported for Invoke operations and should be set to False. The SupportFiltering attribute is not valid and should be set to False. This operation is not valid for a URI if Shell operations are also supported.

-- Put: Put operations are supported on the URI. The SupportFragment attribute is used if the Put operation supports the concept. The SupportFiltering attribute is not valid and should be set to False. This operation is not valid for a URI if Shell operations are also supported.

-- Subscribe: Subscribe operations are supported on the URI. The SupportFragment attribute is not supported for Subscribe operations and should be set to False. The SupportFiltering attribute is not valid and should be set to False. This operation is not valid for a URI if Shell operations are also supported.

-- Shell: Shell operations are supported on the URI. The SupportFragment attribute is not supported for Shell operations and should be set to False. The SupportFiltering attribute is not valid and should be set to False. This operation is not valid for a URI if any other operation is also supported. If a Shell operation is configured for a URI, Get, Put, Create, Delete, Invoke, and Enumerate operations are processed internally within the WS-Management (WinRM) service to manage shells. As a result, the plug-in cannot handle the operations.

Sets the policy for channel-binding token requirements in authentication requests. The following are valid values:

-- Strict: Any request will be denied unless a channel-binding token is present. This setting guarantees that all connections are secured by the use of channel-binding tokens.

-- Relaxed: If a channel-binding token is present in a request, the connection will be secured. If a channel-binding token is not present, the connection will still be accepted. However, it will be vulnerable to attacks that are prevented by the use of channel-binding tokens.

-- None: Any channel-binding tokens that are supplied are ignored.

The value of this parameter is only effective for HTTPS connections.

Specifies the thumbprint of the service certificate.

This value represents the string of two-digit hexadecimal values in the Thumbprint field of the certificate. It specifies the digital public key certificate (X509) of a user account that has permission to perform this action. Certificates are used in client certificate-based authentication. They can be mapped only to local user accounts, and they do not work with domain accounts. To get a certificate thumbprint, use the Get-Item or Get-ChildItem cmdlets in the Windows PowerShell Cert: drive.

Allows the client to be used for certificate authentication. The WS-Management client will try to find the certificate in the computer store. If the client cannot find the certificate in the computer store, the client tries to find it in the current user store. If no matching certificate is found, the user receives an error message.

Allows the client to use Credential Security Service Provider (CredSSP) authentication.

CredSSP authentication allows the user to delegate credentials. This option is designed for commands that run on one remote computer but collect data from or run additional commands on other remote computers.

Caution: CredSSP authentication delegates the user's credentials from the local computer to a remote computer. This practice increases the security risk of the remote operation. If the remote computer is compromised, when credentials are passed to it, the credentials can be used to control the network session.

Specifies the port that the client will use when HTTP is used. By default, HTTP uses port 80. You can specify any value from 1 through 65535.

Specifies the port that the client will use when HTTPS is used. By default, HTTPS uses port 443. You can specify any value from 1 through 65535.

Allows the client to use Digest authentication. Digest authentication is a challenge-response scheme that uses a server-specified data string for the challenge. Only the client computer can initiate a Digest authentication request. The client computer sends a request to the server to authenticate and receives a token string from the server. Then, the client computer sends the resource request, including the user name and a cryptographic hash of the password combined with the token string. Digest authentication is supported for HTTP and for HTTPS. WinRM Shell client scripts and applications can specify Digest authentication, but the WS-Management service does not accept Digest authentication.

Note: Digest authentication over HTTP is not considered secure.

Specifies whether the listener is enabled or disabled. The default is True.

Specifies how to use the security settings that are specified in the Sddl parameter. If the ExactMatch parameter is set to True, the security settings in Sddl are used only to authorize access attempts to the URI exactly as specified by the URI. If ExactMatch is set to false, the security settings in Sddl are used to authorize access attempts to the URIs that begin with the string specified in the URI.

Specifies an input file to use to update the management resource specified by the ResourceURI and SelectorSet.

Specifies the file name of the operations plug-in. Any environment variables that are put in this entry will be expanded in the users' context when a request is received. Because each user could have a different version of the same environment variable, each user could have a different plug-in. This entry cannot be blank and must point to a valid plug-in.

Specifies the host name of the computer on which the WS-Management (WinRM) service is running.

The value must be a fully qualified domain name, an IPv4 or IPv6 literal string, or a wildcard character.

Specifies the maximum time, in milliseconds, that the remote shell will remain open when there is no user activity in the remote shell. The remote shell is automatically deleted after the time that is specified. You can specify any values from 0 through 2147483647. A value of 0 indicates an infinite time-out. The default is 900000 (15 minutes).

Specifies the IPv4 addresses that listeners can use. The following are valid values:

-- If you leave the parameter blank, no IPv4 addresses can be used.

-- If you enter a wildcard character (*), any IPv4 address can be used.

-- If you enter a list of IP ranges, any IP address in the specified ranges can be used. Separate the ranges by using a comma (,), and specify each range as a pair of IPv4 addresses in dotted-decimal format, separated by a hyphen (-). Make sure that the smaller value occurs first in the pair. The ranges are inclusive.

Note: An IPv4 literal string consists of four dotted decimal numbers, each in the range 0 though 255. For example: 192.168.0.0.

Specifies the IPv6 addresses that listeners can use. The following are valid values:

-- If you leave the parameter blank, no IPv6 addresses can be used.

-- If you enter a wildcard character (*), any IPv6 address can be used.

-- If you enter a list of IP ranges, any IP address in the specified ranges can be used. Separate the ranges by using a comma (,"), and specify each range as a pair of IPv6 addresses in cloned-hexadecimal format, separated by a hyphen (-). Make sure that the smaller value occurs first in the pair. The ranges are inclusive.

Note: An IPv6 literal string is enclosed in brackets and contains hexadecimal numbers that are separated by colons. For example: [::1] or [3ffe:ffff::6ECB:0101].

Specifies the name of the certification authority that issued the certificate.

Allows the client to use Kerberos authentication. Kerberos authentication is a scheme in which the client and server mutually authenticate by using Kerberos certificates.

Specifies the IP address or all the IP addresses on which the service is actually listening. This is derived from the Address element based upon the actual IPs associated with the listener. The value of the IP address must be in IPv4 dotted-decimal notation or in IPv6 colon-delimited hexadecimal notation. Multiple ListeningOn entries exist, each entry starting with ListeningOn_. For example:

ListeningOn_1201550598

ListeningOn_1973755898

ListeningOn_1508953035

ListeningOn_1560839940

Specifies the maximum number of elements that can be used in a Pull response. You can specify any value from 1 through 4294967295.

Specifies the maximum number of users who can concurrently perform remote operations on the same computer through a remote shell. New shell connections will be rejected if they exceed the specified limit. You can specify any value from 1 through 100.

Specifies the maximum SOAP data in kilobytes. You can specify any value from 32 through 4294967295.

Specifies the maximum total amount of memory that can be allocated by an active remote shell and all its child processes. You can specify any value from 0 through 2147483647. A value of 0 means that the ability of the remote operations to allocate memory is limited only by the available virtual memory. The default value is 0.

Specifies the maximum number of processes that any shell operation is allowed to start. You can specify any number from 0 through 2147483647. A value of 0 allows for an unlimited number of processes. By default, the limit is five processes per shell.

Specifies the maximum number of concurrent requests that are allowed by the service. You can specify any value from 1 through 4294967295. The limit is applied per provider.

Note: This value is deprecated and should not be used.

Specifies the maximum number of concurrent shells that any user can remotely open on the same system. If this policy setting is enabled, the user will not be able to open new remote shells if the count exceeds the specified limit. If this policy setting is disabled or is not configured, by default, the limit will be set to two remote shells per user. You can specify any number from 0 through 2147483647. A value of 0 allows for an unlimited number of shells.

Specifies the maximum time-out in milliseconds that can be used for any request except for Pull requests. You can specify any number from 500 to 4294967295.

Specifies a display name for the WS-Management session . You can use the name to refer to the session when using other cmdlets, such as Get-PSSession and Enter-PSSession. The name does not have to be unique to the computer or to the current session.

Specifies the display name to use for the plug-in. If an error is returned by the plug-in, the display name will be put in the error XML that is returned to the client application. The name is not locale specific.

Allows the client to use Negotiate authentication. Negotiate authentication is a scheme in which the client sends a request to the server to authenticate. The server determines whether to use the Kerberos protocol or NTLM. The Kerberos protocol is selected to authenticate a domain account, and NTLM is selected for local computer accounts. The user name must be specified in the domain\user_name form for a domain user. The user name must be specified in the server_name\user_name format for a local user on a server computer.

Specifies the extra time in milliseconds that the client computer waits to accommodate for network delay time. You can specify any value from 500 through 4294967295.

Specifies the password for a local or a domain account. It cannot be NULL.

The client computer can specify the credentials to use when creating a shell on a computer. The user name must be specified in the domain\user_name form for a domain user. The user name must be specified in the server_name\user_name format for a local user on a server computer.

If you use this structure, then it should have both the user name and password fields specified. It can be used with Basic, Digest, Negotiate, or Kerberos authentication. The client must explicitly specify the credentials when either Basic or Digest authentication is used.

WS-Management plug-ins are native dynamic link libraries (DLLs) that plug in to and extend the functionality of WS-Management . The WSW-Management Plug-in API provides functionality that enables a user to write plug-ins by implementing certain APIs for supported resource URIs and operations. After the plug-ins are configured for either the WS-Management (WinRM) service or for Internet Information Services (IIS), the plug-ins are loaded in the WS-Management host or in the IIS host, respectively. Remote requests are routed to these plug-in entry points to perform operations.

Specifies the TCP port for which this listener is created. You can specify any value from 1 through 65535.

Specifies an endpoint that represents a distinct type of management operation or value. A service exposes one or more resources, and some resources can have more than one instance. A management resource is similar to a WMI class or to a database table, and an instance is similar to an instance of the class or to a row in the table. For example, the Win32_LogicalDisk class represents a resource. Win32_LogicalDisk="C:\" is a specific instance of the resource.

A Uniform Resource Identifier (URI) contains a prefix and a path to a resource. For example:

https://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_LogicalDisk

https://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_NumericSensor

Specifies the Uniform Resource Identifier (URI) that identifies a specific type of resource, such as a disk or a process, on a computer.

A URI consists of a prefix and a path to a resource. For example:

https://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_LogicalDisk

https://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_NumericSensor

Specifies the Security Descriptor Definition Language (SDDL) for the access control entry. This identifies the security settings that are used to authorize access to a specified resource URI.

Specifies the version of the WS-Management plug-in SDK. The only valid value is 1.

Specifies the process string for the custom shell. You can specify environment variables.

Specifies the length of time before the shell times out due to inactivity. Specify the time-out value in milliseconds.

Specifies the entity that is identified by the certificate.

Specifies whether the plug-in supports the use of options, which are passed within the wsman:OptionSet header in a request message.

Specifies the transport to use to send and receive WS-Management protocol requests and responses. The value must be either HTTP or HTTPS.

Note: The Transport value is set when creating a Listener.

List of remote computers that are connected to the local computer through a trusted network connection. Requests are allowed to be sent to computers specified in this list when using an authentication scheme and transport that does not allow the client to authenticate the service, such as Basic authentication over HTTP.

If a server is specified in TrustedHosts, the client does not authenticate the server's identity, leaving it vulnerable to man-in-the-middle attacks. You should only specify hostnames when the network connection is safe from malicious users, such as in a Domain environment.

The specified host names can be either Domain Name System (DNS) names or IP addresses. The following values are valid:

-- Blank: No hosts are trusted.

-- The asterisk "*" character: All hosts are trusted.

A list of host name patterns separated by commas (,) The host name patterns must be formatted as follows:

-- A string that starts with the wildcard character (*). The string must contain at least two characters. All the hosts that share the suffix are trusted.

-- A string that ends with the wildcard character (*). The string must contain at least two characters. All the hosts that share the prefix are trusted.

-- All NetBIOS names are trusted (for example, strings that do not contain a period).

-- A string without the wildcard character (*): The host named by the string is trusted.

Note: When the TrustedHosts value is set with the Set-Item cmdlet, the Set-Item cmdlet supports an additional parameter -Concatenate. The following example will append a new value (*.domain2.com) to the old value stored in TrustedHost:

Set-Item .\TrustedHosts *.domain2.com -Concatenate -Force

Identifies the URI for which access is authorized based on the value of the Sddl parameter.

A URL prefix on which to accept HTTP or HTTPS requests. This is a string containing only the characters a-z, A-Z, 9-0, underscore (_) and backslash (/). The string must not start with or end with a backslash (/). For example, if the computer name is SampleComputer, the WS-Management client would specify http://SampleMachine/URLPrefix in the destination address.

Specifies the user name for a local account or for a domain account. It cannot have a value of NULL.

The client can specify the credentials to use when creating a shell on a computer. The user name must be specified in the domain\user_name format for a domain account. The user name must be specified in the server_name\user_name format for a local account on a server computer.

If this structure is used, it must have both the username and password fields specified . It can be used with Basic, Digest, Negotiate, or Kerberos authentication. The client must explicitly specify the credentials when either Basic or Digest authentication is used.

Specifies the value of an initialization parameter, which is a plug-in-specific value that is used to specify configuration options.

Specifies the format in which XML is passed to plug-ins through the WSMAN_DATA object. The following are valid values:

Text: Incoming XML data is contained in a WSMAN_DATA_TYPE_TEXT structure, which represents the XML as a PCWSTR memory buffer.

XMLReader: Incoming XML data is contained in a WSMAN_DATA_TYPE_WS_XML_READER structure, which represents the XML as an XmlReader object, which is defined in the WebServices.h header file.

A string that specifies specifies a Uniform Resource Name (URN) that uniquely identifies the namespace.

A string that specifies a language, or a language-region with language and region separated by a hyphen.

Specifies the port that the client will use when HTTP is used. By default, HTTP uses port 80. You can specify any value from 1 through 65535.

Specifies the port that the client will use when HTTPS is used. By default, HTTPS uses port 443. You can specify any value from 1 through 65535.

Note: This value is deprecated and the value is no longer used.

Note: This value is deprecated and the value is no longer used.