Setting and Clearing Trusted Hosts

PowerShell remoting maintains a list of trusted IP addresses and/or machine names on the client side (the machine that issues the command and authenticates at the server). This list is important for you because it governs how you can authenticate to remote computers.

Kerberos: PowerShell’s Default and Secure Authentication

By default, PowerShell supports Kerberos authentication only because it is most secure and authenticates both sides, client and server. It requires an Active Directory though and does not work with IP addresses.

# execute PowerShell code remotely
Invoke-Command { Get-Service } -ComputerName storage2 -Credential AdminUser 

In this example, AdminUser would need to be a domain account recognized on storage2 with the proper permissions to access it.

Enable NTLM Authentication with TrustedHosts

By adding IP addresses and/or computer names to TrustedHosts, you can use NTLM authentication, too. This way, you can use local accounts for authentication and remote to stand-alone systems, systems outside your domain, and also to systems you specify by IP address.

Wildcards are allowed, too, so when you set TrustedHosts to “*”, any computer can use NTLM authentication. That isn’t always clever, though, because now a hacker could unplug a server and replace it with a rouge machine and capture your password because you wouldn’t notice that it is no longer the machine you intended to contact. Therefore, make changes to TrustedHosts only for computers you know are located in a safe environment – that you “trust”.

The TrustedHosts list is accessible only for admins, and only when the WinRM service is running. Launch an elevated PowerShell environment, and make sure the WinRM service is running:

 
PS> Start-Service -Name WinRM  

To view the current content of TrustedHosts, run this:

 
PS> Get-ChildItem -Path WSMan:\localhost\Client\TrustedHosts


   WSManConfig: Microsoft.WSMan.Management\WSMan::localhost\Client

Type            Name                           SourceOfValue   Value                                                          
----            ----                           -------------   -----                                                          
System.String   TrustedHosts   

By default, the list is empty. To reset its content, i.e. specify an IP range, use Set-Item:

 
PS> Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value 192.168.* -Force  

To add more entries, add the -Concatenate parameter. This adds a distinct computer name:

 
PS> Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value storage2 -Concatenate -Force  

Now try and dump the changed content. The result is a comma-separated list supporting wildcards:

 
PS> Get-ChildItem -Path WSMan:\localhost\Client\TrustedHosts


   WSManConfig: Microsoft.WSMan.Management\WSMan::localhost\Client

Type            Name                           SourceOfValue   Value                                                          
----            ----                           -------------   -----                                                          
System.String   TrustedHosts                                   192.168.*,storage2  

To revert TrustedHosts to default and empty it, use Clear-Item:

 
PS> Clear-Item -Path WSMan:\localhost\Client\TrustedHosts -Force  

ReTweet this Tip!