WinRmHelper

Turns a freshly installed Windows node into one that can actually be managed remotely over WinRM / PowerShell Remoting. A default NETSetup install leaves WinRM off, which is why devBuilder04 had to be fixed by hand before anything could be run against it.

Note

Three separate things have to be true, and missing any one of them looks identical from the outside (a connect that times out or is refused):

the WinRM service runs and has an HTTP listener,
the inbound firewall rule is enabled AND not scoped to the local subnet (a dev box egressing from another subnet is silently dropped by the default LocalSubnet scope),
on a non-domain node, LocalAccountTokenFilterPolicy is set, or a local admin authenticates but arrives filtered and every administrative call fails with access denied.

Firewall rules are addressed by -Name, never -DisplayName: display names are localized and match zero rules on a German node.

public static class WinRmHelper

1. Methods

1.1. EnableWinRm(ISystemHost, bool)

Enables WinRM (service, listener, firewall, local-account token policy) on host. Idempotent - safe to run on a node that already has it.

public static void EnableWinRm(ISystemHost host, bool allowRemoteAddressAny = true)

Table 1. Parameters
Name	Type	Description
host	ISystemHost	Host to configure.
allowRemoteAddressAny	bool	When true, widens the WinRM inbound rules from their default LocalSubnet scope to any source. Required when the managing machine lives in a different subnet than the node.