RDP is how you look at a Windows VPS; PowerShell Remoting is how you operate it. WinRM (Windows Remote Management) is built into every modern Windows Server and lets you run commands, scripts, and full interactive sessions over the network without a desktop session \u2014 the foundation of real automation. Here is how to enable it, secure it, and use it day to day.<\/p>\n\n
Everything below works on any Windows VPS that gives you administrator access. If you have not picked a host yet, our comparison table<\/a> is a good place to compare plans \u2014 WinRM sessions are lightweight, but the network throughput of the provider still matters for large file transfers.<\/p>\n\n WinRM is Microsoft\u2019s implementation of the WS-Management protocol. The service listens on TCP 5985 (HTTP) and 5986 (HTTPS), and PowerShell\u2019s remoting cmdlets \u2014 Enter-PSSession, Invoke-Command, New-PSSession \u2014 are just clients for it. It is enabled by default on Windows Server, but the firewall rules and listener are not.<\/p>\n\n From an elevated PowerShell console on the VPS:<\/p>\n\n This starts the WinRM service, creates the HTTP listener, and opens the 5985 firewall rule for the Private and Domain profiles. Verify from your workstation with An interactive session works exactly like a PowerShell window on the server:<\/p>\n\n One catch: if the VPS is not domain-joined (most VPS instances are not), the client must list the server in TrustedHosts or the connection is refused:<\/p>\n\n TrustedHosts falls back to NTLM authentication, which works but is not the most secure option \u2014 if you expose WinRM to the internet rather than a VPN, set up the HTTPS listener below instead.<\/p>\n\n For one-off tasks, skip the interactive session and pipe results straight back:<\/p>\n\n The same call accepts an array of computers \u2014 When a task spans multiple commands, keep a session alive instead of re-authenticating each time:<\/p>\n\n For production, expose WinRM over HTTPS (5986) with a certificate instead of plain HTTP:<\/p>\n\n Connect with You do not need SMB or FTP for transfers \u2014 Copy-Item works across a session in both directions:<\/p>\n\n The transfer runs over the same WinRM channel (5985\/5986), so there are no extra ports to open on the VPS. For very large files it is slower than raw SMB, but for deployment packages and logs it is perfectly adequate and far simpler to script. Keep the session alive for the whole deployment: state such as the current directory and imported modules persists between Invoke-Command calls, which makes multi-step deploys far more predictable.<\/p>\n\n PowerShell 7 runs on Linux and macOS, and the remoting cmdlets behave identically \u2014 the same Enter-PSSession and Invoke-Command calls work from a MacBook or a CI runner. WinRM is also scriptable over plain HTTP, which makes it easy to drive from build pipelines.<\/p>\n\n WinRM needs full administrator access to the server, and Hostwinds<\/a> Windows VPS plans ship with exactly that, so remoting works out of the box.<\/p>\n\n WinRM will not replace RDP for GUI work, but for scripts, scheduled jobs, and multi-server automation it is the difference between clicking and commanding. Compare plans side by side in our comparison table<\/a> to find a host with the network throughput your WinRM sessions deserve.<\/p>","protected":false},"excerpt":{"rendered":"What WinRM Actually Is<\/h2>\n\n
Enable It in One Command<\/h2>\n\n
Enable-PSRemoting -Force<\/code><\/pre>\n\nTest-WSMan 203.0.113.10<\/code> \u2014 you should get a response with the protocol version.<\/p>\n\nConnect from Your Workstation<\/h2>\n\n
$cred = Get-Credential\nEnter-PSSession -ComputerName 203.0.113.10 -Credential $cred<\/code><\/pre>\n\nSet-Item WSMan:\\localhost\\Client\\TrustedHosts -Value '203.0.113.10' -Concatenate -Force<\/code><\/pre>\n\nRun Commands Without a Session<\/h2>\n\n
Invoke-Command -ComputerName 203.0.113.10 -Credential $cred -ScriptBlock {\n Get-Volume | Sort-Object DriveLetter |\n Select-Object DriveLetter,\n @{n='FreeGB';e={[math]::Round($_.SizeRemaining\/1GB,1)}}\n}<\/code><\/pre>\n\nInvoke-Command -ComputerName srv1,srv2,srv3 ...<\/code> \u2014 and runs against them in parallel with a default throttle of 32. That is how one console window administers a whole fleet of VPS instances.<\/p>\n\nPersistent Sessions for Scripted Jobs<\/h2>\n\n
$s = New-PSSession -ComputerName 203.0.113.10 -Credential $cred\nInvoke-Command -Session $s -ScriptBlock { Copy-Item C:\\app\\*.zip D:\\deploy\\ -Force }\nInvoke-Command -Session $s -ScriptBlock { & D:\\deploy\\deploy.ps1 }\nRemove-PSSession $s<\/code><\/pre>\n\nLock It Down: HTTPS Listener<\/h2>\n\n
$cert = Get-ChildItem Cert:\\LocalMachine\\My |\n Where-Object Subject -like '*vps.example.com*' | Select-Object -First 1\nNew-Item -Path WSMan:\\localhost\\Listener\\Transport\\HTTPS `\n -Address * -HostName vps.example.com `\n -CertificateThumbprint $cert.Thumbprint -Force<\/code><\/pre>\n\nEnter-PSSession -ComputerName vps.example.com -Credential $cred -UseSSL<\/code>. Also raise the default 500 KB message size limit if you push large payloads: Set-Item WSMan:\\localhost\\MaxEnvelopeSizekb -Value 2048<\/code>.<\/p>\n\nCopy Files Over WinRM<\/h2>\n\n
Copy-Item C:\\deploy\\app.zip -ToSession $s -Destination C:\\deploy\\app.zip\nCopy-Item C:\\logs\\app.log -FromSession $s -Destination D:\\collected<\/code><\/pre>\n\nTroubleshooting WinRM<\/h2>\n\n
Get-Service WinRM<\/code> must show Running; if it keeps stopping, set Set-Service WinRM -StartupType Automatic<\/code>.<\/li>Test-NetConnection 203.0.113.10 -Port 5985<\/code> verifies the port is reachable at all.<\/li>Not on Windows? Use pwsh<\/h2>\n\n