![WinRM 与工作组和 VLAN 子网的连接问题](https://linux22.com/image/781071/WinRM%20%E4%B8%8E%E5%B7%A5%E4%BD%9C%E7%BB%84%E5%92%8C%20VLAN%20%E5%AD%90%E7%BD%91%E7%9A%84%E8%BF%9E%E6%8E%A5%E9%97%AE%E9%A2%98.png)
情况:
- 1 台服务器(Windows Server 2022)(192.168.15.5)
- 1 个客户端(Windows 11)(192.168.5.5)
- Unifi 网络设置,两台机器位于不同的 VLAN(子网)上
在服务器上:
- 跑步
Winrm quickconfig
- 跑步
Enable-PSRemoting
- 运行
Get-NetFirewallRule -Name 'WINRM*' | Get-NetFirewallAddressFilter | Set-NetFirewallAddressFilter -RemoteAddress Any
(以确保其他子网能够连接)
在客户端上:
- 跑步
Winrm quickconfig
- 跑步
Enable-PSRemoting
- 跑步
Set-Item WSMan:\localhost\Client\TrustedHosts –Value "192.168.15.5"
运行时test-wsman [server ip]
,有时候有效,有时候无效:
呼叫 1(似乎不错):
PS C:\WINDOWS\system32> test-wsman 192.168.15.5
wsmid : http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd
ProtocolVersion : http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd
ProductVendor : Microsoft Corporation
ProductVersion : OS: 0.0.0 SP: 0.0 Stack: 3.0
第二次呼叫(几秒钟后完成):
PS C:\WINDOWS\system32> test-wsman 192.168.15.5
test-wsman : <f:WSManFault xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault" Code="2150859046" Machine="WO
RKSTATION"><f:Message>WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet. </f:Message></f:WSManFault>
At line:1 char:1
+ test-wsman 192.168.15.5
+ ~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (192.168.15.5:String) [Test-WSMan], InvalidOperationException
+ FullyQualifiedErrorId : WsManError,Microsoft.WSMan.Management.TestWSManCommand
执行时的结果相同Test-NetConnection 192.168.15.5 -p 5985
(有时有效,有时无效)。
服务器 WinRM 配置:
Service
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
MaxConcurrentOperations = 4294967295
MaxConcurrentOperationsPerUser = 1500
EnumerationTimeoutms = 240000
MaxConnections = 300
MaxPacketRetrievalTimeSeconds = 120
AllowUnencrypted = false
Auth
Basic = true
Kerberos = true
Negotiate = true
Certificate = false
CredSSP = true
CbtHardeningLevel = Relaxed
DefaultPorts
HTTP = 5985
HTTPS = 5986
IPv4Filter = *
IPv6Filter = *
EnableCompatibilityHttpListener = false
EnableCompatibilityHttpsListener = false
CertificateThumbprint
AllowRemoteAccess = true
一些观察:
- 与服务器的 SMB 或 RDP 连接正常运行
- Unifi 防火墙已正确配置
- Windows Server 防火墙应该已正确配置(否则我会惊讶于“有时”请求有效)
netstat -aon
服务器上显示它正在正确监听正确的端口(5985)
知道可能出现什么情况以及为什么 WinRM / Remote PowerShell 不能可靠地运行吗?
可能是因为 Unifi 无法可靠地处理 VLAN 上的流量(但为什么 RDP 可以完美运行)?
答案1
感谢评论,我们得以进行进一步调查。Windows 防火墙没有阻止任何内容。
最终,Unifi 用以下签名阻止了连续的请求:
ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement
通过Unifi,您可以通过以下方式查看System logs
=>Threats
在这里,我们可以抑制网络内特定机器的这种威胁。