1

I'm trying to find a way I can edit the 'trusted hosts' list under local group policy remotely. Path from within Local Group Policy is: \local computer policy\computer configuration\administrative templates\windows components\windows remote management(WindRM)\WinRM Client\trusted hosts

I can open the local group policy editor by doing this: gpedit.msc /gpcomputer: [IP of remote machine] From there I can add the additional trusted host but am looking for a way I can automate this using Powershell or Batch as have over 100 servers to do this for.

The server I am connecting FROM is already in the trusted hosts list of all client servers - I need to add a second one.

I've tried a few of ways so far: set-item wsman:[client-IP]\Client\TrustedHosts -value [trusted-IP]

set-item wsman:\[client-IP]\Client\TrustedHosts -value [trusted-IP]

set-item \[client-IP]\wsman\Client\TrustedHosts -value [trusted-IP]

neither of which work - I can't actually find any documentation about using 'wsman' remotely so not even sure I have the paths correct.

If doing this remotely is not a possibility does anyone know how to edit the local group policy (path to trusted hosts above) using a batch file as I can push the batch file out to all servers and have a scheduled task execute it.

Thanks for any help available.

EDIT: I've found, due to the way this has been previously setup in local group policy rather than through WINRM I am unable to edit this list using WSMAN - even locally.

I need to be able to edit the local group policy remotely, the only way I can currently think of it to write a batch file which can update the local group policy for me, push that out to all client servers and set a scheduled task to run the batch file.

I can't however, figure out how to edit local group policy from batch - anyone know of any documentation?

lukester85
  • 41
  • 3
  • 1
    You say that you're doing this in the local Group Policy. Why aren't you doing this with domain Group Policy? – joeqwerty Feb 02 '16 at 16:59
  • 1
    'cos its not in a domain :) – lukester85 Feb 03 '16 at 09:35
  • Wow. More than 100 servers and no AD. That sounds like a nightmare to manage. – joeqwerty Feb 03 '16 at 16:13
  • it can be, generally it's ok as i have a trusted host and a lot gets done via powershell from there. Just need to add an extra trusted host and I'll be all set. We are not in a domain because these are VPS's rented to 3rd parties. We just manage them (updates / patches etc) If there is a better way of doing this which i am missing I'm all ears! – lukester85 Feb 04 '16 at 16:47

1 Answers1

0

Try using WinRS from your workstation to invoke WinRM on the remote target with the new Trusted Host list. Works for me, but I don't have a workgroup only setup like yours to test that respect.

winrs -r:target.domain.com winrm set winrm/config/client @{TrustedHosts="*.domain.com,1.2.3.4,localhost"}
OR
winrs -r:target.domain.com -u:administrator -p:P4$$word winrm set winrm/config/client @{TrustedHosts="*.domain.com,1.2.3.4,localhost"}
Clayton
  • 4,483
  • 16
  • 24