I am trying to set up remote management on a few machines. I can successfully execute commands on the remote machine from my computer, but I don’t want anyone to be able to do so.

I have tried setting the trusted hosts on the remote computer, and restarted the service but it doesn’t seem to be doing anything.

For example, on the remote machine:

I then restart the winrm service.

How come I can still run the remote commands from my laptop? Shouldn’t it prevent the command from being executed?

I’m running the command the following way:

Where $cred was generated using get-credential domain/username.

I have read a few things about TrustedHosts, and they seem to give conflicting reports as to what it does. Some people seem to say that it prevents commands from being executed on computers not listed in the Trusted Hosts list. Others say it’s a list of computers that can run commands on that machine.

MSDN says: “Specifies the list of remote computers that are trusted.” That seems to imply that it is the second option (a list of computers that can execute commands on the machine).

What am I doing wrong?

Thanks

TrustedHosts doesn’t do what you think it does. Unlike Unix .rhosts, this setting is for the PowerShell client, not the remote server endpoint. This is why it’s found at:

If it was relevant to the listener, it would be under the Service node.

As the other answer touches on, this is typically used in non-domain or mixed environments to prevent your client from sending an NTLM challenge-response or basic authentication attempt to an untrusted remote machine. Why? Because a remote rogue server may capture this information and use it to compromise your network. When you’re in a mixed environment, the only protection available is SSL and many may opt to disable this through AllowUnencrypted = $false, again in the Client node of the WSMAN drive.

So, how do you limit incoming connections? You should have made the connection by now and started to look under the WSMAN:\localhost\Service node on the remote server. If you do this, you’ll see:

Now, looking down this list, you’ll see some pertinently named properties like IPv4Filter and IPv6Filter. Guess what these do 😉