Tech Advisor

Configure WinRM 2.0

Check version

windows>winrm id

Configuring systems individually

You may configure the Windows systems to monitor individually, without Windows Group Policy.

Note If you choose the default WinRM configuration, supply Kerberos authentication settings in

zProperties. The Kerberos authentication process requires a Key Distribution Center (KDC), which acts as

both an authentication server and a ticket granting server. Microsoft Active Directory is a KDC, so the zWinKDC

value must be set to the IP address of the Active Directory server, and Zenoss Core collectors must be able to send

TCP/IP packets to it. The value of zWinRMUserName must include a fully qualified domain name (for example,

jsmith@zenoss.com) and zWinRMPassword must include the password of the user account.

Follow these steps to enable this ZenPack to monitor a Windows system.

1 Log on to the Windows system to enable, and open the Windows Firewall with Advanced Security utility, or

its equivalent.

2 Open port 5985 (for HTTP) or 5986 (for HTTPS) for WinRM, and then close the utility.

3 Start a command window as Administrator.

winrm get winrm/config

4 Configure the system to accept WS-Management requests from other systems.

winrm quickconfig

5 Configure the maximum number of concurrent operations per user.

winrm s winrm/config/service

@{MaxConcurrentOperationsPerUser="4294967295"}

Note This is the maximum value. The default (5) is inadequate, because Zenoss Core opens concurrent

requests for each WQL query and set of Perfmon counters. If the maximum value is inappropriate for your

environment, 50 should be adequate.

6 Configure the maximum number of shells per user.

winrm s winrm/config/winrs @{MaxShellsPerUser="2147483647"}

7 Configure the idle timeout.

winrm s winrm/config/winrs @{IdleTimeout="7200000"}

8 Optional: Configure HTTP. The default is HTTPS.

winrm s winrm/config/service @{AllowUnencrypted="true"}

For more information about configuring HTTPS, see Configuring HTTPS on page 49.

9 Optional: Configure Basic Authentication. The default is Kerberos.

winrm s winrm/config/service/auth @{Basic="true"}