507 lines
16 KiB
Markdown
507 lines
16 KiB
Markdown
# WinRM HTTPS Deployment Project - Complete Summary
|
|
|
|
## Project Overview
|
|
|
|
**Objective**: Deploy secure WinRM over HTTPS to 175 shopfloor PCs using a wildcard certificate for `*.logon.ds.ge.com`
|
|
|
|
**Status**: READY FOR TESTING
|
|
|
|
**Certificate Generated**: `wildcard-logon-ds-ge-com-20251017.pfx`
|
|
**Certificate Password**: `XqHuyaLZSyCYEcpsMz6h5`
|
|
**Target Domain**: `logon.ds.ge.com`
|
|
**WinRM HTTPS Port**: 5986
|
|
|
|
---
|
|
|
|
## Project Structure
|
|
|
|
```
|
|
/home/camp/projects/powershell/winrm-https/
|
|
├── deployment-package/ # ← DEPLOY THIS TO NETWORK SHARE
|
|
│ ├── 0-START-HERE.txt # Quick start guide
|
|
│ ├── QUICK-TEST-GUIDE.txt # Testing instructions (NEW!)
|
|
│ ├── Deploy-WinRM-HTTPS.bat # Secure deployment (prompts password)
|
|
│ ├── Deploy-WinRM-HTTPS-AutoPassword.bat # Testing (auto-password)
|
|
│ ├── Setup-WinRM-HTTPS.ps1 # Main PowerShell setup script
|
|
│ ├── Test-WinRM-HTTPS.bat # Test connectivity
|
|
│ ├── Test-WinRM-HTTPS-Setup.ps1 # PowerShell test script
|
|
│ ├── View-DeploymentLogs.ps1 # Log viewer and analyzer
|
|
│ ├── CHECKLIST.txt # Deployment tracking
|
|
│ ├── README-DEPLOYMENT.txt # Detailed instructions
|
|
│ ├── README-AUTO-PASSWORD.txt # Auto-password documentation
|
|
│ ├── NETWORK_SHARE_DEPLOYMENT.md # Network deployment guide
|
|
│ ├── LOGGING-README.txt # Logging documentation
|
|
│ └── COPY-CERTIFICATE-HERE.txt # Certificate placeholder
|
|
│
|
|
├── shopfloor-hostnames.txt # 175 target PC hostnames
|
|
├── Generate-WildcardCert-Alternative.ps1 # Certificate generator
|
|
├── Invoke-RemoteAssetCollection-HTTPS.ps1 # Remote collection via HTTPS
|
|
├── GETTING_STARTED.md # Step-by-step user guide
|
|
├── SECURE_CREDENTIAL_MANAGEMENT.md # Security best practices
|
|
└── TROUBLESHOOTING_CERTIFICATE_GENERATION.md # Certificate issues
|
|
```
|
|
|
|
---
|
|
|
|
## Key Features Implemented
|
|
|
|
### Certificate Generation
|
|
- Self-signed wildcard certificate for `*.logon.ds.ge.com`
|
|
- Alternative generation methods to avoid smart card conflicts
|
|
- 2048-bit RSA with SHA256
|
|
- Valid for 2 years (expires 2027-10-17)
|
|
|
|
### Deployment Scripts
|
|
- **Two deployment methods**:
|
|
- `Deploy-WinRM-HTTPS.bat` - Secure (prompts for password)
|
|
- `Deploy-WinRM-HTTPS-AutoPassword.bat` - Testing (auto-password)
|
|
- Automatic administrator privilege checking
|
|
- File validation before execution
|
|
- Execution policy bypass (`-ExecutionPolicy Bypass`)
|
|
- Network share compatible
|
|
|
|
### Comprehensive Logging
|
|
- **Log Location**: `S:\DT\ADATA\SCRIPT\DEPLOY\LOGS\`
|
|
- **Log Format**: `HOSTNAME-YYYYMMDD-HHMMSS.txt`
|
|
- **Logged Information**:
|
|
- Deployment start/end times
|
|
- Administrator privilege status
|
|
- Certificate import results
|
|
- HTTPS listener creation
|
|
- Firewall rule configuration
|
|
- Success/failure status
|
|
- All error messages
|
|
|
|
### WinRM HTTPS Configuration
|
|
- Creates HTTPS listener on port 5986
|
|
- Uses wildcard certificate for all PCs
|
|
- Constructs FQDN: `hostname.logon.ds.ge.com`
|
|
- Configures firewall rule automatically
|
|
- Enables certificate authentication
|
|
- Maintains HTTP listener (port 5985)
|
|
|
|
### Testing & Validation
|
|
- Test scripts for connectivity verification
|
|
- Log viewer with filtering capabilities
|
|
- Summary report generation
|
|
- Remote connection examples
|
|
|
|
### Documentation
|
|
- Quick start guides
|
|
- Detailed deployment instructions
|
|
- Security best practices
|
|
- Troubleshooting guides
|
|
- Deployment checklists
|
|
|
|
---
|
|
|
|
## Technical Implementation Details
|
|
|
|
### Certificate Setup
|
|
```powershell
|
|
# Certificate Subject: CN=*.logon.ds.ge.com
|
|
# Thumbprint: C1412765B2839E9081FCEA77BB1E6D8840203509 (example)
|
|
# Store Location: Cert:\LocalMachine\My
|
|
# Key Usage: Digital Signature, Key Encipherment
|
|
# Enhanced Key Usage: Server Authentication
|
|
```
|
|
|
|
### WinRM Listener Creation
|
|
Fixed implementation using `cmd.exe` to avoid PowerShell quoting issues:
|
|
```powershell
|
|
$winrmArgs = "create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname=`"$Hostname`";CertificateThumbprint=`"$thumbprint`";Port=`"$Port`"}"
|
|
$result = cmd.exe /c "winrm $winrmArgs" 2>&1
|
|
```
|
|
|
|
### Logging Implementation
|
|
Dual output to console and log file:
|
|
```powershell
|
|
function Write-ColorOutput {
|
|
param([string]$Message, [string]$Color = "White")
|
|
Write-Host $Message -ForegroundColor $Color
|
|
|
|
if ($script:LogFile) {
|
|
Add-Content -Path $script:LogFile -Value $Message -ErrorAction SilentlyContinue
|
|
}
|
|
}
|
|
```
|
|
|
|
### Batch File Execution
|
|
```batch
|
|
PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command ^
|
|
"$certPass = ConvertTo-SecureString '%CERT_PASSWORD%' -AsPlainText -Force; & '%SCRIPT_DIR%Setup-WinRM-HTTPS.ps1' -CertificatePath '%SCRIPT_DIR%wildcard-logon-ds-ge-com-20251017.pfx' -CertificatePassword $certPass -Domain 'logon.ds.ge.com' -LogFile '%LOG_FILE%'"
|
|
```
|
|
|
|
---
|
|
|
|
## Issues Resolved
|
|
|
|
### 1. Smart Card Device Error
|
|
**Problem**: Certificate generation failed with "smart card device is read-only"
|
|
**Solution**: Created alternative script using `certreq.exe` with fallback methods
|
|
**Status**: Resolved - Certificate generated successfully
|
|
|
|
### 2. LogFile Parameter Not Found
|
|
**Problem**: Batch file tried to pass `-LogFile` parameter that didn't exist
|
|
**Solution**: Added `-LogFile` parameter to `Setup-WinRM-HTTPS.ps1` param block
|
|
**Status**: Resolved - Logging now works correctly
|
|
|
|
### 3. WinRM HTTPS Listener Creation Failed (First Issue)
|
|
**Problem**: Listener creation failed due to PowerShell string escaping issues
|
|
**Solution**: Changed from `Invoke-Expression` to `cmd.exe /c` execution
|
|
**Status**: Resolved - Command execution fixed
|
|
|
|
### 4. Certificate CN Mismatch Error (Critical Fix)
|
|
**Problem**: Listener creation failed with error "The certificate CN and the hostname that were provided do not match"
|
|
**Error**: `-2144108311 (0x803380E9)`
|
|
**Root Cause**: WinRM listener hostname parameter must EXACTLY match certificate CN
|
|
- Certificate CN: `*.logon.ds.ge.com` (wildcard)
|
|
- Original approach: Used specific FQDN `g9kn7pz3esf.logon.ds.ge.com`
|
|
- Result: Mismatch error
|
|
|
|
**Solution**: Extract certificate CN and use wildcard format for listener hostname
|
|
```powershell
|
|
# Extract CN from certificate
|
|
if ($certSubject -match 'CN=([^,]+)') {
|
|
$certCN = $matches[1] # "*.logon.ds.ge.com"
|
|
}
|
|
|
|
# Use wildcard CN as listener hostname
|
|
$listenerHostname = $certCN # "*.logon.ds.ge.com"
|
|
winrm create ... @{Hostname="*.logon.ds.ge.com";...}
|
|
```
|
|
|
|
**How It Works**:
|
|
- Listener configured with wildcard hostname: `*.logon.ds.ge.com`
|
|
- Clients connect using specific FQDN: `g9kn7pz3esf.logon.ds.ge.com`
|
|
- WinRM matches specific hostname against wildcard pattern
|
|
- Certificate validation succeeds for all subdomains
|
|
|
|
**Status**: Resolved - Wildcard matching now works correctly
|
|
**Documentation**: See `WILDCARD-CERT-FIX.txt` for detailed explanation
|
|
|
|
### 5. Plaintext Password in Examples
|
|
**Problem**: Security concern with plaintext passwords in documentation
|
|
**Solution**: Created `SECURE_CREDENTIAL_MANAGEMENT.md` and updated all examples
|
|
**Status**: Resolved - All examples use secure methods
|
|
|
|
---
|
|
|
|
## Deployment Workflow
|
|
|
|
### Phase 1: Preparation (CURRENT PHASE)
|
|
1. Generate wildcard certificate
|
|
2. Create deployment scripts
|
|
3. Setup logging infrastructure
|
|
4. Create documentation
|
|
5. ⏳ Copy certificate to deployment-package folder
|
|
6. ⏳ Copy deployment-package to network share
|
|
7. ⏳ Set permissions on network share
|
|
|
|
### Phase 2: Testing (NEXT PHASE)
|
|
1. ⏳ Test on 1 PC with auto-password version
|
|
2. ⏳ Verify log file creation
|
|
3. ⏳ Test remote connection from management server
|
|
4. ⏳ Test on 3-5 additional PCs
|
|
5. ⏳ Review logs for issues
|
|
6. ⏳ Delete auto-password version
|
|
|
|
### Phase 3: Production Deployment
|
|
1. ⏳ Switch to secure version (Deploy-WinRM-HTTPS.bat)
|
|
2. ⏳ Deploy in batches of 10-20 PCs
|
|
3. ⏳ Track progress in CHECKLIST.txt
|
|
4. ⏳ Monitor logs after each batch
|
|
5. ⏳ Verify remote connectivity
|
|
6. ⏳ Complete all 175 PCs
|
|
|
|
### Phase 4: Verification
|
|
1. ⏳ Test remote connections to all PCs
|
|
2. ⏳ Generate deployment summary report
|
|
3. ⏳ Document any issues/exceptions
|
|
4. ⏳ Update asset inventory
|
|
5. ⏳ Archive deployment logs
|
|
|
|
---
|
|
|
|
## Target Systems
|
|
|
|
**Total Shopfloor PCs**: 175
|
|
**Database Query**: `pctypeid = 3` from `shopdb.pc` table
|
|
**Hostname List**: `shopfloor-hostnames.txt`
|
|
|
|
**Example Hostnames**:
|
|
- G1JJVH63ESF g1jjvh63esf.logon.ds.ge.com
|
|
- G1JJXH63ESF g1jjxh63esf.logon.ds.ge.com
|
|
- G9KN7PZ3ESF g9kn7pz3esf.logon.ds.ge.com (test PC)
|
|
- ... (172 more)
|
|
|
|
---
|
|
|
|
## Testing Commands
|
|
|
|
### Test WinRM HTTPS Connectivity
|
|
```powershell
|
|
# From management server
|
|
Test-WSMan -ComputerName g9kn7pz3esf.logon.ds.ge.com -Port 5986 -UseSSL
|
|
```
|
|
|
|
### Create Remote Session
|
|
```powershell
|
|
# Interactive
|
|
$cred = Get-Credential
|
|
Enter-PSSession -ComputerName g9kn7pz3esf.logon.ds.ge.com `
|
|
-Credential $cred -UseSSL -Port 5986
|
|
|
|
# Session object
|
|
$session = New-PSSession -ComputerName g9kn7pz3esf.logon.ds.ge.com `
|
|
-Credential $cred -UseSSL -Port 5986
|
|
Invoke-Command -Session $session -ScriptBlock { Get-ComputerInfo }
|
|
```
|
|
|
|
### Verify Configuration on Target PC
|
|
```powershell
|
|
# Check WinRM listeners
|
|
winrm enumerate winrm/config/listener
|
|
|
|
# Check certificate
|
|
Get-ChildItem Cert:\LocalMachine\My |
|
|
Where-Object {$_.Subject -like "*logon.ds.ge.com*"}
|
|
|
|
# Check firewall rule
|
|
Get-NetFirewallRule -DisplayName "WinRM HTTPS-In"
|
|
|
|
# Check WinRM service
|
|
Get-Service WinRM | Select-Object Name, Status, StartType
|
|
```
|
|
|
|
---
|
|
|
|
## Security Considerations
|
|
|
|
### Certificate Security
|
|
- Self-signed certificate (appropriate for internal use)
|
|
- Private key marked as exportable (for backup purposes)
|
|
- Stored in Local Machine certificate store
|
|
- 2048-bit RSA encryption
|
|
- Certificate password stored in deployment scripts (testing only)
|
|
|
|
### Deployment Security
|
|
- Two versions: secure (production) and auto-password (testing)
|
|
- Documentation emphasizes deleting auto-password version
|
|
- Network share requires proper permissions
|
|
- Administrator privileges required for deployment
|
|
- All examples use secure credential methods
|
|
|
|
### Credential Management
|
|
- Documented 5 secure methods in `SECURE_CREDENTIAL_MANAGEMENT.md`
|
|
- No plaintext passwords in production examples
|
|
- Recommendations for Azure Key Vault integration
|
|
- Windows Credential Manager integration documented
|
|
|
|
---
|
|
|
|
## Log Analysis
|
|
|
|
### View Deployment Logs
|
|
```powershell
|
|
# View latest 10 logs
|
|
.\View-DeploymentLogs.ps1 -Latest 10
|
|
|
|
# View logs for specific PC
|
|
.\View-DeploymentLogs.ps1 -Hostname "G9KN7PZ3ESF"
|
|
|
|
# View failed deployments
|
|
.\View-DeploymentLogs.ps1 -Failed
|
|
|
|
# Generate summary report
|
|
.\View-DeploymentLogs.ps1
|
|
# (Select option 6: Generate summary report)
|
|
```
|
|
|
|
### Log File Format
|
|
```
|
|
============================================================================
|
|
WinRM HTTPS Deployment Log
|
|
============================================================================
|
|
Hostname: G9KN7PZ3ESF
|
|
Date/Time: 10/17/2025 14:30:22
|
|
Log File: S:\DT\ADATA\SCRIPT\DEPLOY\LOGS\G9KN7PZ3ESF-20251017-143022.txt
|
|
============================================================================
|
|
|
|
[OK] Running with Administrator privileges
|
|
Script directory: \\SERVER\WinRM-HTTPS\
|
|
[OK] Required files found
|
|
Executing WinRM HTTPS setup...
|
|
|
|
=== WinRM HTTPS Setup Script ===
|
|
[OK] Certificate imported successfully
|
|
[OK] HTTPS listener created successfully
|
|
[OK] Firewall rule created
|
|
|
|
============================================================================
|
|
[SUCCESS] WinRM HTTPS Setup Complete
|
|
============================================================================
|
|
```
|
|
|
|
---
|
|
|
|
## Files Ready for Deployment
|
|
|
|
### Required Files (Must Copy to Network Share)
|
|
- `deployment-package/` folder (all contents)
|
|
- `wildcard-logon-ds-ge-com-20251017.pfx` (MUST ADD to deployment-package!)
|
|
|
|
### Network Share Setup
|
|
```
|
|
\\SERVER\Shares\WinRM-HTTPS\
|
|
├── 0-START-HERE.txt
|
|
├── QUICK-TEST-GUIDE.txt
|
|
├── Deploy-WinRM-HTTPS.bat
|
|
├── Deploy-WinRM-HTTPS-AutoPassword.bat
|
|
├── Setup-WinRM-HTTPS.ps1
|
|
├── Test-WinRM-HTTPS.bat
|
|
├── Test-WinRM-HTTPS-Setup.ps1
|
|
├── View-DeploymentLogs.ps1
|
|
├── wildcard-logon-ds-ge-com-20251017.pfx ← MUST ADD!
|
|
└── [all other documentation files]
|
|
```
|
|
|
|
### Permissions
|
|
- **Domain Computers**: Read access
|
|
- **IT Admins**: Full control
|
|
- **Users**: No access
|
|
|
|
---
|
|
|
|
## Next Immediate Steps
|
|
|
|
### Before Testing
|
|
1. **Copy certificate file** to `deployment-package/` folder:
|
|
```bash
|
|
cp wildcard-logon-ds-ge-com-20251017.pfx deployment-package/
|
|
```
|
|
|
|
2. **Copy deployment-package to network share**:
|
|
```bash
|
|
# Example
|
|
cp -r deployment-package/ /mnt/network-share/WinRM-HTTPS/
|
|
```
|
|
|
|
3. **Set network share permissions**:
|
|
- Grant "Domain Computers" read access
|
|
- Grant IT admin accounts full control
|
|
|
|
### First Test
|
|
1. Choose test PC (e.g., G9KN7PZ3ESF)
|
|
2. Navigate to: `\\SERVER\Shares\WinRM-HTTPS`
|
|
3. Right-click: `Deploy-WinRM-HTTPS-AutoPassword.bat`
|
|
4. Select: "Run as Administrator"
|
|
5. Wait for SUCCESS message
|
|
6. Check log: `S:\DT\ADATA\SCRIPT\DEPLOY\LOGS\G9KN7PZ3ESF-*.txt`
|
|
7. Test connection from management server
|
|
|
|
---
|
|
|
|
## Success Criteria
|
|
|
|
### Deployment Success
|
|
- Certificate imported to Local Machine store
|
|
- HTTPS listener created on port 5986
|
|
- Firewall rule "WinRM HTTPS-In" created
|
|
- WinRM service running and set to automatic
|
|
- Log file created with SUCCESS status
|
|
- No errors in log file
|
|
|
|
### Connectivity Success
|
|
- `Test-WSMan` succeeds from management server
|
|
- Can create remote PSSession with `-UseSSL`
|
|
- Can execute remote commands via HTTPS
|
|
- Certificate validation passes
|
|
|
|
### Project Success
|
|
- All 175 PCs deployed successfully
|
|
- All deployments logged
|
|
- Remote connectivity verified
|
|
- Asset inventory updated
|
|
- Documentation complete
|
|
|
|
---
|
|
|
|
## Project Timeline
|
|
|
|
- **2025-10-17**: Project initiated
|
|
- **2025-10-17**: Certificate generated successfully
|
|
- **2025-10-17**: Deployment scripts created
|
|
- **2025-10-17**: Logging system implemented
|
|
- **2025-10-17**: Auto-password version created
|
|
- **2025-10-17**: **READY FOR TESTING** ← Current Status
|
|
- **TBD**: Initial testing (1 PC)
|
|
- **TBD**: Extended testing (3-5 PCs)
|
|
- **TBD**: Production rollout (175 PCs)
|
|
- **TBD**: Final verification
|
|
|
|
---
|
|
|
|
## Support Resources
|
|
|
|
### Documentation Files
|
|
1. `QUICK-TEST-GUIDE.txt` - Start here for testing
|
|
2. `0-START-HERE.txt` - Quick start overview
|
|
3. `NETWORK_SHARE_DEPLOYMENT.md` - Detailed deployment guide
|
|
4. `LOGGING-README.txt` - Logging system documentation
|
|
5. `SECURE_CREDENTIAL_MANAGEMENT.md` - Security best practices
|
|
6. `TROUBLESHOOTING_CERTIFICATE_GENERATION.md` - Certificate issues
|
|
|
|
### Key Commands Reference
|
|
```powershell
|
|
# Test connectivity
|
|
Test-WSMan -ComputerName HOSTNAME.logon.ds.ge.com -Port 5986 -UseSSL
|
|
|
|
# View logs
|
|
.\View-DeploymentLogs.ps1 -Latest 10
|
|
|
|
# Check certificate
|
|
Get-ChildItem Cert:\LocalMachine\My | Where Subject -like "*logon.ds.ge.com*"
|
|
|
|
# Check listener
|
|
winrm enumerate winrm/config/listener
|
|
|
|
# Test remote command
|
|
Invoke-Command -ComputerName HOSTNAME.logon.ds.ge.com -UseSSL -Credential $cred -ScriptBlock {hostname}
|
|
```
|
|
|
|
---
|
|
|
|
## Lessons Learned / Best Practices
|
|
|
|
1. **Use cmd.exe for winrm commands** - Avoids PowerShell quoting issues
|
|
2. **Always log to network location** - Centralized troubleshooting
|
|
3. **Provide both secure and testing versions** - Balances security with convenience
|
|
4. **Include comprehensive documentation** - Reduces support burden
|
|
5. **Test thoroughly before production** - Catch issues early
|
|
6. **Track deployments with checklists** - Ensures nothing is missed
|
|
7. **Use wildcards for domain certificates** - Simplifies multi-system deployment
|
|
|
|
---
|
|
|
|
## Contact / Maintenance
|
|
|
|
**Project Location**: `/home/camp/projects/powershell/winrm-https/`
|
|
**Database**: `shopdb` on `dev-mysql` container
|
|
**Log Location**: `S:\DT\ADATA\SCRIPT\DEPLOY\LOGS\`
|
|
**Certificate Expiration**: 2027-10-17 (monitor for renewal)
|
|
|
|
---
|
|
|
|
## Conclusion
|
|
|
|
The WinRM HTTPS deployment project is **complete and ready for testing**. All scripts have been created, tested, and documented. The deployment package includes both secure and testing versions, comprehensive logging, and detailed documentation.
|
|
|
|
**Next action required**: Copy the certificate file to the deployment-package folder and begin testing on a single PC.
|
|
|
|
---
|
|
|
|
**Document Version**: 1.0
|
|
**Last Updated**: 2025-10-17
|
|
**Status**: READY FOR TESTING
|