---

PS C:\Users\Administrator> hostname
WIN-FBBB7KE4F78
PS C:\Users\Administrator> Get-Service WinRM

Status   Name               DisplayName
------   ----               -----------
Running  WinRM              Windows Remote Management (WS-Manag...


PS C:\Users\Administrator> winrm enumerate winrm/config/listener
Listener
    Address = *
    Transport = HTTP
    Port = 5985
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = 10.20.0.110, 127.0.0.1, ::1, fe80::8f0:dd2d:7d3:5cc2%3

PS C:\Users\Administrator> Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select-Object DisplayName, Enabled, Direction, Action

DisplayName                         Enabled Direction Action
-----------                         ------- --------- ------
Remote Desktop - Shadow (TCP-In)       True   Inbound  Allow
Remote Desktop - User Mode (TCP-In)    True   Inbound  Allow
Remote Desktop - User Mode (UDP-In)    True   Inbound  Allow


PS C:\Users\Administrator> Get-NetIPAddress | Where-Object {$_.AddressFamily -eq "IPv4"}


IPAddress         : 10.20.0.110
InterfaceIndex    : 3
InterfaceAlias    : Ethernet Instance 0
AddressFamily     : IPv4
Type              : Unicast
PrefixLength      : 24
PrefixOrigin      : Dhcp
SuffixOrigin      : Dhcp
AddressState      : Preferred
ValidLifetime     : 00:38:01
PreferredLifetime : 00:38:01
SkipAsSource      : False
PolicyStore       : ActiveStore

IPAddress         : 127.0.0.1
InterfaceIndex    : 1
InterfaceAlias    : Loopback Pseudo-Interface 1
AddressFamily     : IPv4
Type              : Unicast
PrefixLength      : 8
PrefixOrigin      : WellKnown
SuffixOrigin      : WellKnown
AddressState      : Preferred
ValidLifetime     :
PreferredLifetime :
SkipAsSource      : False
PolicyStore       : ActiveStore



PS C:\Users\Administrator> Get-DnsClientServerAddress

InterfaceAlias               Interface Address ServerAddresses
                             Index     Family
--------------               --------- ------- ---------------
Ethernet Instance 0                  3 IPv4    {10.20.0.1}
Ethernet Instance 0                  3 IPv6    {}
Loopback Pseudo-Interface 1          1 IPv4    {}
Loopback Pseudo-Interface 1          1 IPv6    {fec0:0:0:ffff::1, fec0:0:0:ffff::2, fec0:0:0:ffff::3}


PS C:\Users\Administrator> $hostname = "windows-ad-01"
PS C:\Users\Administrator>
PS C:\Users\Administrator> $certificate = New-SelfSignedCertificate `
>>   -DnsName $env:COMPUTERNAME, $hostname `
>>   -CertStoreLocation Cert:\LocalMachine\My
PS C:\Users\Administrator>
PS C:\Users\Administrator> Get-ChildItem WSMan:\localhost\Listener |
>>   Where-Object {
>>     $_.Keys -contains "Transport=HTTPS" -or
>>     $_.Keys -contains "Transport=HTTP"
>>   } |
>>   Remove-Item -Recurse -Force
PS C:\Users\Administrator>
PS C:\Users\Administrator> New-Item `
>>   -Path WSMan:\localhost\Listener `
>>   -Transport HTTPS `
>>   -Address * `
>>   -CertificateThumbPrint $certificate.Thumbprint `
>>   -Force


   WSManConfig: Microsoft.WSMan.Management\WSMan::localhost\Listener

Type            Keys                                Name
----            ----                                ----
Container       {Transport=HTTPS, Address=*}        Listener_1305953032


PS C:\Users\Administrator>
PS C:\Users\Administrator> New-NetFirewallRule `
>>   -DisplayName "WinRM HTTPS" `
>>   -Direction Inbound `
>>   -Protocol TCP `
>>   -LocalPort 5986 `
>>   -Action Allow `
>>   -Profile Any


Name                          : {5c1251cf-4e2a-40c4-9f2d-93d39fd4e801}
DisplayName                   : WinRM HTTPS
Description                   :
DisplayGroup                  :
Group                         :
Enabled                       : True
Profile                       : Any
Platform                      : {}
Direction                     : Inbound
Action                        : Allow
EdgeTraversalPolicy           : Block
LooseSourceMapping            : False
LocalOnlyMapping              : False
Owner                         :
PrimaryStatus                 : OK
Status                        : The rule was parsed successfully from the store. (65536)
EnforcementStatus             : NotApplicable
PolicyStoreSource             : PersistentStore
PolicyStoreSourceType         : Local
RemoteDynamicKeywordAddresses : {}
PolicyAppId                   :
PackageFamilyName             :



PS C:\Users\Administrator> # DNS как хотели
PS C:\Users\Administrator> Set-DnsClientServerAddress -InterfaceIndex 3 -ServerAddresses 10.20.0.100
PS C:\Users\Administrator>
PS C:\Users\Administrator> # RDP service
PS C:\Users\Administrator> Set-ItemProperty `
>>   -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" `
>>   -Name "fDenyTSConnections" `
>>   -Value 0
PS C:\Users\Administrator>
PS C:\Users\Administrator> Set-Service -Name TermService -StartupType Automatic
PS C:\Users\Administrator> Start-Service -Name TermService
PS C:\Users\Administrator>
PS C:\Users\Administrator> # Явное правило RDP на любой профиль
PS C:\Users\Administrator> New-NetFirewallRule `
>>   -DisplayName "RDP TCP 3389" `
>>   -Direction Inbound `
>>   -Protocol TCP `
>>   -LocalPort 3389 `
>>   -Action Allow `
>>   -Profile Any `
>>   -ErrorAction SilentlyContinue


Name                          : {5c567d0e-7e26-4dc5-94a5-61f4db750c84}
DisplayName                   : RDP TCP 3389
Description                   :
DisplayGroup                  :
Group                         :
Enabled                       : True
Profile                       : Any
Platform                      : {}
Direction                     : Inbound
Action                        : Allow
EdgeTraversalPolicy           : Block
LooseSourceMapping            : False
LocalOnlyMapping              : False
Owner                         :
PrimaryStatus                 : OK
Status                        : The rule was parsed successfully from the store. (65536)
EnforcementStatus             : NotApplicable
PolicyStoreSource             : PersistentStore
PolicyStoreSourceType         : Local
RemoteDynamicKeywordAddresses : {}
PolicyAppId                   :
PackageFamilyName             :



PS C:\Users\Administrator>
PS C:\Users\Administrator> Set-NetFirewallRule -DisplayGroup "Remote Desktop" -Enabled True -Profile Any
PS C:\Users\Administrator>
PS C:\Users\Administrator> # WinRM HTTPS убедиться, что сервис перечитал listener
PS C:\Users\Administrator> Restart-Service WinRM
PS C:\Users\Administrator>
PS C:\Users\Administrator>
PS C:\Users\Administrator>
PS C:\Users\Administrator>
PS C:\Users\Administrator>
PS C:\Users\Administrator> Get-NetTCPConnection -State Listen -LocalPort 3389,5986

LocalAddress                        LocalPort RemoteAddress                       RemotePort State       Appl
                                                                                                         iedS
                                                                                                         etti
                                                                                                         ng
------------                        --------- -------------                       ---------- -----       ----
::                                  5986      ::                                  0          Listen
::                                  3389      ::                                  0          Listen
0.0.0.0                             3389      0.0.0.0                             0          Listen


PS C:\Users\Administrator> Get-Service TermService,WinRM

Status   Name               DisplayName
------   ----               -----------
Running  TermService        Remote Desktop Services
Running  WinRM              Windows Remote Management (WS-Manag...


PS C:\Users\Administrator> winrm enumerate winrm/config/listener
Listener
    Address = *
    Transport = HTTPS
    Port = 5986
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint = 0629D374C4DC2F16049E5C0785C802FD74A017BF
    ListeningOn = 10.20.0.110, 127.0.0.1, ::1, fe80::8f0:dd2d:7d3:5cc2%3

PS C:\Users\Administrator> Get-NetFirewallRule -DisplayName "RDP TCP 3389", "WinRM HTTPS" | Select DisplayName,Enabled,Profile,Direction,Action


DisplayName : WinRM HTTPS
Enabled     : True
Profile     : Any
Direction   : Inbound
Action      : Allow

DisplayName : RDP TCP 3389
Enabled     : True
Profile     : Any
Direction   : Inbound
Action      : Allow



PS C:\Users\Administrator>