Configuring WinRM on Hyper-V hosts
Configure Windows™ Remote Management to allow the BigFix Inventory server to gather data about virtualization topology of virtual machines installed in your infrastructure.
Before you begin
- To retrieve the data that is required to properly calculate PVU, you must be logged in as a local administrator on the Hyper-V host. It is necessary because the Windows Management Instrumentation call that accesses MsCluster namespace requires an administrative account.
- Hardcoded and select-only statements are run over WinRM. The obtained data is stored in a database schema. BigFix Inventory does not modify the Hyper-V settings and does not affect it any other way.
About this task
Procedure
- Defining HTTP and HTTPS listeners. By default, communication
with the WinRM service is disabled because there are no listeners
defined. To check whether there are any listeners that are currently
defined, type the following command:
winrm enumerate winrm/config/listener
. If there is no output returned, there are no listeners defined. - Enabling WinRM Negotiate authentication scheme. The
WinRM service offers several authentication schemes to be used to
authenticate the client side. The BigFix Inventory server
uses Negotiate authentication scheme, which is enabled by default.
- Setting WinRM AllowUnencrypted property. The
server requires the property to be set to "true".
- Verifying the listener. After you define the HTTP
or HTTPS listener, verify that you can remotely connect to the Hyper-V
server.
- Verifying whether the Virtual System Management service
is running. To verify that the service that provides Hyper-V management
is running, go to
on the Hyper-V server.
Look for the service called Hyper-V Virtual Machine Management
- If the service exists, but is not running, start the service.
- If the service does not exist, the Hyper-V host was not configured properly.
- Verifying the MsCluster resource. If the server
is clustered, verify that you can access the MsCluster namespace.
On the Hyper-V server, type the following command into the Windows
command line:
winrm enumerate wmi/root/MsCluster/* -dialect:"http://schemas.microsoft.com/wbem/wsman/1/WQL" -filter:"SELECT PrivateProperties, Type FROM MsCluster_Resource WHERE Type='Network Name' AND Flags='1'"
If this command fails, refer to Microsoft documentation about WMI for MsCluster.
- Verifying remote connectivity and the server certificate. To
verify remote connectivity and the server certificate, type the following
command into the Windows command line: Restriction: Enter the following command on the Windows command line of the BigFix Inventory server. If the server is not installed on a computer that runs on a Windows operating system, use a computer that is not the Hyper-V host and runs on Windows 2008 or higher.
winrm set winrm/config/client @TrustedHosts={"<Hyper-V_server_name>"} winrm get winrm/config/client /r:<transport>:// <Hyper-V_server_name>:<port>/wsman /u:<user_id> /p:<password> /a:Negotiate
Where- <transport>
- Is either HTTP or HTTPS.
- <Hyper-V_server_name>
- Is the host name of the Hyper-V server. If you are using HTTPS, the host name must match the CN in the certificate.
- <port>
- Is the port number on which the Windows Remote Management client for the HTTP or HTTPS transport listens.
- <user_id>
- Is the user ID that is used to connect to the Hyper-V server.
- <password>
- Is the password that is used to connect to the Hyper-V server.
For example:winrm set winrm/config/client @TrustedHosts={"myhyperv.ibm.com"} winrm get winrm/config/client /r:https:// myhyperv.ibm.com:5986/wsman /u:administrator /p:abc /a:Negotiate
The following error is often returned when a self-signed certificate is used is:WSManFault Message = The server certificate on the destination computer (myhyperv.ibm.com:5986) has the following errors: The SSL certificate is signed by an unknown certificate authority.
If you receive this error, export the self-signed certificate from the Hyper-V host, and import it on the BigFix Inventory host. For other errors, refer to Microsoft documentation for the returned error code.Tip: For more information about Hyper-V configuration, see the following document: Hyper-V connection fails CODVM0005E.