PowerShell Logo Small

Disable-PSRemoting



This is the built-in help made by Microsoft for the command 'Disable-PSRemoting', in PowerShell version 5 - as retrieved from Windows version 'Microsoft Windows Server 2012 R2 Standard' PowerShell help files on 2016-06-23.

For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.

SYNOPSIS

Prevents remote users from running commands on the local computer.

SYNTAX


Disable-PSRemoting [-Force] [-Confirm] [-WhatIf] [<CommonParameters>]



Search powershellhelp.space

DESCRIPTION


The Disable-PSRemoting cmdlet prevents users on other computers from running commands on the local computer.


Disable-PSRemoting blocks remote access to all session configurations on the local computer. This prevents remote users from creating temporary or persistent sessions to the
local computer. Disable-PSRemoting does not prevent users of the local computer from creating sessions ("PSSessions") on the local computer or remote computers.


To re-enable remote access to all session configurations, use the Enable-PSRemoting cmdlet. To enable remote access to selected session configurations, use the AccessMode
parameter of the Set-PSSessionConfiguration cmdlet. You can also use the Enable-PSSessionConfiguration and Disable-PSSessionConfiguration cmdlets to enable and disable
session configurations for all users. For more information about session configurations, see about_Session_Configurations (http://go.microsoft.com/fwlink/?LinkID=145152).


In Windows PowerShell 2.0, Disable-PSRemoting prevents all users from creating user-managed sessions ("PSSessions") to the local computer. In Windows PowerShell 3.0,
Disable-PSRemoting prevents users on other computers from creating user-managed sessions on the local computer, but allows users of the local computer to create user-managed
"loopback" sessions.


To run this cmdlet, start Windows PowerShell with the "Run as administrator" option.


CAUTION: On systems that have both Windows PowerShell 3.0 and the Windows PowerShell 2.0 engine, do not use Windows PowerShell 2.0 to run the Enable-PSRemoting and
Disable-PSRemoting cmdlets. The commands might appear to succeed, but the remoting is not configured correctly. Remote commands, and later attempts to enable and disable
remoting, are likely to fail.



<

RELATED LINKS

Online Version: http://go.microsoft.com/fwlink/p/?linkid=289573
Disable-PSSessionConfiguration
Enable-PSRemoting
Get-PSSessionConfiguration
Register-PSSessionConfiguration
Set-PSSessionConfiguration
Unregister-PSSessionConfiguration
WSMan Provider



REMARKS

<

Examples


-------------------------- EXAMPLE 1 --------------------------

PS C:\>Disable-PSRemoting



This command prevents remote access to all session configurations on the computer.






-------------------------- EXAMPLE 2 --------------------------

PS C:\>Disable-PSRemoting -Force



This command prevents remote access all session configurations on the computer without prompting.






-------------------------- EXAMPLE 3 --------------------------

PS C:\>Disable-PSRemoting -Force


[ADMIN] PS C:\>New-PSSession -ComputerName localhost


Id Name ComputerName State Configuration Availability
-- ---- ------------ ----- ------------- ------------
1 Session1 Server02... Opened Microsoft.PowerShell Available
# On Server02 remote computer:
PS C:\>New-PSSession -ComputerName Server01

[SERVER01] Connecting to remote server failed with the following error
message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.
+ CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PSRemotingTransportException
+ FullyQualifiedErrorId : PSSessionOpenFailed



This example shows the effect of using the Disable-PSRemoting cmdlet. To run this command sequence, start Windows PowerShell with the "Run as administrator" option.

The first command uses the Disable-PSRemoting cmdlet to disable all registered session configurations on the Server01 computer.

The second command uses the New-PSSession cmdlet to create a remote session to the local computer (also known as a "loopback"). The command succeeds.

The third command is run on the Server02 remote computer. The command uses the New-PSSession cmdlet to create a session to the Server01 remote computer. Because remote
access is disabled, the command fails.






-------------------------- EXAMPLE 4 --------------------------

PS C:\>Disable-PSRemoting -force

[ADMIN] PS C:\>Get-PSSessionConfiguration | Format-Table -Property Name, Permission -Auto

Name Permission
---- ----------
microsoft.powershell NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
microsoft.powershell.workflow NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
microsoft.powershell32 NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
microsoft.ServerManager NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
WithProfile NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed


[ADMIN] PS C:\>Enable-PSRemoting -Force
WinRM already is set up to receive requests on this machine.
WinRM already is set up for remote management on this machine.

[ADMIN] PS C:\>Get-PSSessionConfiguration | Format-Table -Property Name, Permission -Auto

Name Permission
---- ----------
microsoft.powershell BUILTIN\Administrators AccessAllowed
microsoft.powershell.workflow BUILTIN\Administrators AccessAllowed
microsoft.powershell32 BUILTIN\Administrators AccessAllowed
microsoft.ServerManager BUILTIN\Administrators AccessAllowed
WithProfile BUILTIN\Administrators AccessAllowed



This example shows the effect on the session configurations of using the Disable-PSRemoting and Enable-PSRemoting cmdlets.

The first command uses the Disable-PSRemoting cmdlet to disable remote access to all session configurations. The Force parameter suppresses all user prompts.

The second command uses the Get-PSSessionConfiguration cmdlet to display the session configurations on the computer. The command uses a pipeline operator to send the results
to a Format-Table command, which displays only the Name and Permission properties of the configurations in a table.

The output shows that only remote users are denied access to the configurations. Members of the Administrators group on the local computer are allowed to use the session
configurations. The output also shows that the command affects all session configurations, including the user-created "WithProfile" session configuration.

The third command uses the Enable-PSRemoting cmdlet to re-enable remote access to all session configurations on the computer. The command uses the Force parameter to
suppress all user prompts and to restart the WinRM service without prompting.

The fourth command uses the Get-PSSessionConfiguration and Format-Table cmdlets to display the names and permissions of the session configurations. The results show that the
"AccessDenied" security descriptors have been removed from all session configurations.






-------------------------- EXAMPLE 5 --------------------------

PS C:\>Register-PSSessionConfiguration -Name Test -FilePath .\TestEndpoint.pssc -ShowSecurityDescriptorUI

[ADMIN] PS C:\>Get-PSSessionConfiguration | Format-Table -Property Name, Permission -Wrap

Name Permission
---- ----------
microsoft.powershell BUILTIN\Administrators AccessAllowed
Test NT AUTHORITY\INTERACTIVE AccessAllowed, BUILTIN\Administrators AccessAllowed,
DOMAIN01\User01 AccessAllowed

[ADMIN] PS C:\>Disable-PSRemoting -Force


[ADMIN] PS C:\>Get-PSSessionConfiguration | Format-Table -Property Name, Permission -Wrap

Name Permission
---- ----------
microsoft.powershell NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
Test NT AUTHORITY\NETWORK AccessDenied, NTAUTHORITY\INTERACTIVE AccessAllowed,
BUILTIN\Administrators AccessAllowed, DOMAIN01\User01 AccessAllowed

# Domain01\User01

PS C:\>New-PSSession -ComputerName Server01 -ConfigurationName Test
[Server01] Connecting to remote server failed with the following error message : Access is denied. For more information, see the about_Rem
ote_Troubleshooting Help topic.
+ CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PSRemotingTransportException
+ FullyQualifiedErrorId : PSSessionOpenFailed



This example demonstrates that the Disable-PSRemoting cmdlet disables remote access to all session configurations, including session configurations with custom security
descriptors.

The first command uses the Register-PSSessionConfiguration cmdlet to create the Test session configuration. The command uses the FilePath parameter to specify a session
configuration file that customizes the session and the ShowSecurityDescriptorUI parameter to display a dialog box that sets permissions for the session configuration. In the
Permissions dialog box, we create custom full-access permissions for the Domain01\User01 user.

The second command uses the Get-PSSessionConfiguration and Format-Table cmdlets to display the session configurations and their properties. The output shows that the Test
session configuration allows interactive access and special permissions for the Domain01\User01 user.

The third command uses the Disable-PSRemoting cmdlet to disable remote access to all session configurations.

The fourth command uses the Get-PSSessionConfiguration and Format-Table cmdlets to display the session configurations and their properties. The output shows that an
AccessDenied security descriptor for all network users is added to all session configurations, including the Test session configuration. Although the other security
desriptors are not changed, the "network_deny_all" security descriptor takes precedence.

The fifth command shows that the Disable-PSRemoting command prevents even the Domain01\User01 user with special permissions to the Test session configuration from using the
Test session configuration to connect to the computer remotely.






-------------------------- EXAMPLE 6 --------------------------

PS C:\>Disable-PSRemoting -Force


[ADMIN] PS C:\>Get-PSSessionConfiguration | Format-Table -Property Name, Permission -Auto

Name Permission
---- ----------
microsoft.powershell NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
microsoft.powershell.workflow NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
microsoft.powershell32 NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
microsoft.ServerManager NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
WithProfile NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed

[ADMIN] PS C:\>Set-PSSessionConfiguration -Name Microsoft.ServerManager -AccessMode Remote -Force

[ADMIN] PS C:\>Get-PSSessionConfiguration | Format-Table -Property Name, Permission -Auto

Name Permission
---- ----------
microsoft.powershell NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
microsoft.powershell.workflow NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
microsoft.powershell32 NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed
microsoft.ServerManager BUILTIN\Administrators AccessAllowed
WithProfile NT AUTHORITY\NETWORK AccessDenied, BUILTIN\Administrators AccessAllowed



This example shows how to re-enable remote access only to selected session configurations.

The first command uses the Disable-PSRemoting cmdlet to disable remote access to all session configurations.

The second command uses the Get-PSSessionConfiguration and Format-Table cmdlets to display the session configurations and their properties. The output shows that an
AccessDenied security descriptor for all network users is added to all session configurations.

The third command uses the Set-PSSessionConfiguration cmdlet. The command uses the AccessMode parameter with a value of Remote to enable remote access to the
Microsoft.ServerManager session configuration. You can also use the AccessMode parameter to enable Local access and to disable session configurations.

The fourth command uses the Get-PSSessionConfiguration and Format-Table cmdlets to display the session configurations and their properties. The output shows that the
AccessDenied security descriptor for all network users is removed, thereby restoring remote access to the Microsoft.ServerManager session configuration.