plugins/12-winrm.ps1

[CmdletBinding()]
param(
    $Config
)

if ($Config.WinRM) {
    #Write-Verbose 'Enabling WinRM'
    #Enable-PSRemoting -Force | Out-Null
    #winrm quickconfig -transport:https
    #winrm enumerate winrm/config/listener
    Write-Verbose 'Configuring firewall WinRM exception'
    #Enable-NetFirewallRule -DisplayGroup 'Windows Remote Management'
    netsh advfirewall firewall set rule group="Windows Remote Management" new enable=yes
    if ($Config.WinRM.Https) {
        if (-not $Config.WinRM.Certificate) {
            Write-Verbose 'Generating and installing self-signed certificate'
            #$Cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName $env:COMPUTERNAME
            $SerialNumber = Get-Random -Minimum 1 -Maximum ([int]::MaxValue)
            $Param = 
                '-r',
                '-n',"CN=$env:COMPUTERNAME",
                '-sk',"$env:COMPUTERNAME",
                '-sr','localmachine',
                '-ss','my',
                '-a','sha256',
                '-eku','1.3.6.1.5.5.7.3.1',
                '-sky','exchange',
                '-sp','Microsoft RSA SChannel Cryptographic Provider',
                '-sy','12',
                '-#',$SerialNumber
            & $PSScriptRoot\makecert.exe $Param
            $Cert = Get-Item Cert:\LocalMachine\My\* | ? SerialNumber -match ('0*{0:X}' -f $SerialNumber)
        } else {
            try {
                $Cert = Get-Item Cert:\LocalMachine\My\$($Config.WinRM.Certificate)
            } catch {
                throw "Cannot find certificate with thumbprint $($Config.WinRM.Certificate)"
            }
        }
        Write-Verbose 'Configuring HTTPS WinRM listener'
        winrm create winrm/config/Listener?Address=*+Transport=HTTPS @"
@{Hostname="$env:COMPUTERNAME";CertificateThumbprint="$($Cert.Thumbprint)";Port="5986"}
"@

        if ($UserMapping = $Config.WinRM.UserMapping) {
            Write-Verbose 'Enabling certificate-based authentication'
            Set-Item -Path WSMan:\localhost\Service\Auth\Certificate -Value $true
            $UserMapping | Get-Member -MemberType Properties | % {
                $User = $_.Name
                $CertThumbPrint = $UserMapping.($_.Name)
                $PlainTextPassword = ($Config.Users | ? Name -eq $User).Password
                $Password = ConvertTo-SecureString $PlainTextPassword -AsPlainText -Force
                $Credential = New-Object System.Management.Automation.PSCredential($User,$Password)
                Write-Verbose "Creating user mapping for $User, cert thumbprint $CertThumbPrint"
                New-Item -Path WSMan:\localhost\ClientCertificate -Subject "$User@localhost" -URI * -Issuer $CertThumbPrint -Credential $Credential -Force
            }
        }
    }
}