6.5

Configure a WinRM HTTPS Listener
All queries go through WinRM, so you need to congure a WinRM HTTPS listener on the machine where
the broker agent is installed.
Procedure
u
To congure a WinRM HTTPS listener on the remote server, run the following command on the
PowerShell prompt:
winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="xenapp-
dc.vcops.local";CertificateThumbprint= " 4D9157F66867A73A55A0B9F6DAC045EB52D4BF9A"}
Configure a Firewall
By default, WinRM uses port 5986 for a HTTPS listener. Add a new rewall rule to allow inbound
connections on the 5986 port.
Procedure
u
To add a new rewall rule to allow inbound connections on the 5986 port, run the following command:
netsh advfirewall firewall add rule name="Windows Remote Management (HTTPS-In)" dir=in
action=allow protocol=TCP localport=5986
If you work with an Azure VM, add a new endpoint for 5986 port on the VM seings page. If you work
with an AWS EC2 instance, add a new rule to its security group.
Update the etc/host file for DNS Resolution
Update the etc/host le to x the DNS resolution if you are using HOSTNAME as the fully qualied domain
name instead of the IP address.
Install the Certificate on the Client
Procedure
1 Open Windows Management Console.
2 Go to File > Remove Snap In.
3 Click  > Add.
4 Select Computer Account, click Next, and then click Finish. Click OK on the wizard to continue.
The wizard closes and Console1 snap in is visible.
5 Select and expand the .
6 Select Trusted Root  Authorities > , go the tree panel on the right, and right-
click All Tasks > Import.
The Welcome to Certicate Import wizard appears.
7 Click Next and browse to the certicate copied from the host.
8 Click Next.
A message conrms the success of the import operation.
The imported certicates are displayed in the tree panel on the right.
Chapter 6 Enabling HTTP or HTTPS Protocols for PowerShell Remoting
VMware, Inc. 33