{"id":570,"date":"2026-08-08T22:57:09","date_gmt":"2026-08-08T22:57:09","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=570"},"modified":"2026-08-08T22:57:09","modified_gmt":"2026-08-08T22:57:09","slug":"powershell-remoting-winrm-https-windows-vps","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/","title":{"rendered":"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">PowerShell Remoting over plain HTTP (port 5985) works, but it is encrypted with Kerberos or NTLM only \u2014 and on a workgroup VPS with <code>TrustedHosts<\/code> in play, authentication can fall back to NTLM, which is weak and easily blocked by security policies. The production answer is WinRM over HTTPS on port 5986 with a certificate your client trusts. This guide shows how to enable WinRM, bind an HTTPS listener with a proper certificate, configure <code>TrustedHosts<\/code> versus Kerberos, open the firewall, and run <code>Invoke-Command<\/code> without tripping over the classic error codes. If you are comparing plans while you automate, the <a href=\"https:\/\/windows-vps.org\/#providers\">Windows VPS provider comparison<\/a> notes which hosts give you full admin control (required for WinRM setup) versus locked-down shared plans.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Enable WinRM and Check the Default Listener<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On the VPS, open an elevated PowerShell and enable the service. This creates the default HTTP listener on port 5985:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Enable-PSRemoting -Force\nGet-Service WinRM                 # should be Running\nGet-Item WSMan:\\localhost\\Service\\EnableCompatibilityHooks\nGet-ChildItem WSMan:\\localhost\\Listener | Select-Object Name, Transport, Port<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you intend to use HTTPS exclusively, you can disable the HTTP listener later. Many administrators keep both and firewall 5985 off from the internet \u2014 see Step 4.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Get a Certificate the Client Trusts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WinRM over HTTPS requires a certificate with the server&#8217;s name in the Subject (or SAN). A self-signed cert works only if you import it into the client&#8217;s <em>Trusted Root Certification Authorities<\/em> store \u2014 otherwise you will fight the <code>0x8033810C<\/code> &#8220;certificate not trusted&#8221; error forever. For a real setup, buy a cheap domain cert or use Let&#8217;s Encrypt with a DNS challenge so the CN matches your VPS hostname:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Check for an existing cert with a private key (LocalMachine\\My):\nGet-ChildItem Cert:\\LocalMachine\\My | Select-Object Thumbprint, Subject, NotAfter<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you test with a self-signed cert, generate one with the correct CN (this is the single most common cause of HTTPS listener failures):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$cert = New-SelfSignedCertificate -DnsName 'vps1.example.com' -CertStoreLocation Cert:\\LocalMachine\\My -KeyExportPolicy Exportable\n$cert.Thumbprint<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Create the HTTPS Listener on Port 5986<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Bind the listener to the certificate thumbprint and the server&#8217;s hostname. The <code>Hostname<\/code> must match the cert&#8217;s CN or SAN:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$thumb = 'THUMBPRINT-FROM-STEP-2'\nNew-WSManInstance -ResourceURI winrm\/config\/Listener -SelectorSet @{Transport='HTTPS'} -ValueSet @{Hostname='vps1.example.com'; CertificateThumbprint=$thumb; Port=5986}\n\n# Verify both listeners:\nGet-ChildItem WSMan:\\localhost\\Listener | Select-Object Transport, Port, Enabled<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note the requirement: the listener&#8217;s <code>Hostname<\/code> and the certificate must agree, and the certificate must be in <code>LocalMachine\\My<\/code> with a private key. If the listener silently fails to appear, that agreement is almost always the problem. For more on certificates on Windows Server, our guide to <a href=\"https:\/\/windows-vps.org\/blog\/https-iis-windows-vps-ssl-http2-hsts\/\">HTTPS and SSL certificates on a Windows VPS<\/a> walks through the same trust chain from the IIS side.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Firewall Rules \u2014 5986 In, 5985 Out of Reach<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Allow the HTTPS port and, if you are locking things down, block the plain HTTP port from remote sources:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>New-NetFirewallRule -DisplayName 'WinRM HTTPS' -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow\nNew-NetFirewallRule -DisplayName 'Block WinRM HTTP remote' -Direction Inbound -Protocol TCP -LocalPort 5985 -Action Block -RemoteAddress Any<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the VPS sits behind a provider-level firewall or security group, open TCP 5986 there too. Remember: 5986 is HTTPS, 5985 is HTTP \u2014 mixing them up produces &#8220;connection refused&#8221; on the exact port you think you opened.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: TrustedHosts vs. Kerberos \u2014 Pick Deliberately<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Authentication is where most WinRM setups go sideways. Two mechanisms:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Mechanism<\/th><th>When it works<\/th><th>Security notes<\/th><\/tr><\/thead><tbody><tr><td>Kerberos<\/td><td>Domain-joined machines; both sides in the same AD forest<\/td><td>Strongest option; no TrustedHosts needed<\/td><\/tr><tr><td>NTLM + TrustedHosts<\/td><td>Workgroup VPS (the common case)<\/td><td>Adds the host to TrustedHosts; avoid wildcard <code>*<\/code>; use HTTPS so NTLM credentials travel encrypted<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">For a standalone Windows VPS, the practical setup is NTLM over HTTPS. On the <strong>client<\/strong> machine, add the server to TrustedHosts (scoped, not wildcard):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Set-Item WSMan:\\localhost\\Client\\TrustedHosts -Value 'vps1.example.com' -Concatenate\n# View:\nGet-Item WSMan:\\localhost\\Client\\TrustedHosts<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">With HTTPS you can also skip TrustedHosts entirely by using <code>-Authentication Negotiate<\/code> and explicit credentials, since the channel is already encrypted \u2014 that is the configuration most security teams approve. A broader look at secure remote administration, including when RDP still beats PowerShell for interactive work, is in our <a href=\"https:\/\/windows-vps.org\/blog\/rdp-vs-vpn-remote-windows-vps-access\/\">RDP vs VPN comparison for Windows VPS access<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Run Invoke-Command Securely<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">From the client, with a domain or local credential object, using <code>-UseSSL<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$cred = Get-Credential 'vps1\\ops-admin'\nInvoke-Command -ComputerName 'vps1.example.com' -Credential $cred -UseSSL -SessionOption (New-PSSessionOption -OperationTimeoutSec 120) -ScriptBlock {\n    Get-Service WinRM\n    Get-NetTCPConnection -State Listen | Where-Object LocalPort -in 5985,5986\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Better still, create a reusable session and pass it around:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$s = New-PSSession -ComputerName 'vps1.example.com' -Credential $cred -UseSSL\nInvoke-Command -Session $s -ScriptBlock { Set-Service w32time -StartupType Automatic }\nRemove-PSSession $s<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Common Errors and Their Fixes<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Error<\/th><th>Meaning<\/th><th>Fix<\/th><\/tr><\/thead><tbody><tr><td>0x8033810C<\/td><td>Certificate not trusted \/ CN mismatch on the client<\/td><td>Import the cert into Trusted Root store; check CN matches the hostname you connect to<\/td><\/tr><tr><td>0x80070005 (Access denied)<\/td><td>User lacks permission<\/td><td>Add the account to <em>Remote Management Users<\/em> or <em>Administrators<\/em> on the VPS<\/td><\/tr><tr><td>Connection refused on 5986<\/td><td>No HTTPS listener or firewall block<\/td><td>Verify listener with <code>Get-ChildItem WSMan:\\localhost\\Listener<\/code>; open TCP 5986<\/td><\/tr><tr><td>&#8220;The WinRM client cannot process the request&#8221;<\/td><td>TrustedHosts missing (NTLM path)<\/td><td><code>Set-Item WSMan:\\localhost\\Client\\TrustedHosts<\/code> with the exact hostname\/IP<\/td><\/tr><tr><td>0x80338028 (timeout)<\/td><td>Network path blocked<\/td><td><code>Test-NetConnection vps1 -Port 5986<\/code> from the client<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Wrap-Up<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WinRM over HTTPS is the difference between &#8220;it works on my machine&#8221; automation and automation you can defend in a security review: a trusted certificate, port 5986 only, scoped TrustedHosts, and explicit credentials in every <code>Invoke-Command<\/code>. The full recipe \u2014 enable WinRM, bind an HTTPS listener whose CN matches the cert, open 5986, and pick Kerberos or scoped TrustedHosts \u2014 takes about fifteen minutes on a fresh Windows Server VPS. When you pick the host, make sure the plan gives you administrator access and a static IP, both of which matter for certificate validity; compare plans on <a href=\"https:\/\/windows-vps.org\/#features\">our Windows VPS feature comparison<\/a> before you buy.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>PowerShell Remoting over plain HTTP (port 5985) works, but it is encrypted with Kerberos or NTLM only \u2014 and on a workgroup VPS with TrustedHosts in play, authentication can fall back to NTLM, which is weak and easily blocked by security policies. The production answer is WinRM over HTTPS on port 5986 with a certificate &#8230; <a title=\"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup\" class=\"read-more\" href=\"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/\" aria-label=\"Read more about PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":1,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-570","post","type-post","status-publish","format-standard","hentry","category-tutorials-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup - Windows VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup\" \/>\n<meta property=\"og:description\" content=\"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-08T22:57:09+00:00\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/\",\"name\":\"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"datePublished\":\"2026-08-08T22:57:09+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup - Windows VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/","og_locale":"en_US","og_type":"article","og_title":"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup","og_description":"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup","og_url":"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/","og_site_name":"Windows VPS Blog","article_published_time":"2026-08-08T22:57:09+00:00","author":"windows-vps","twitter_card":"summary_large_image","twitter_misc":{"Written by":"windows-vps","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/","url":"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/","name":"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"datePublished":"2026-08-08T22:57:09+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/powershell-remoting-winrm-https-windows-vps\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"PowerShell Remoting (WinRM) over HTTPS on a Windows VPS: Secure Automation Setup"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/570","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=570"}],"version-history":[{"count":1,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/570\/revisions"}],"predecessor-version":[{"id":571,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/570\/revisions\/571"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=570"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=570"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=570"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}