All PowerShell versions
If you use PowerShell at home or in an environment without central group policy management, here are some additional steps you should consider to make PowerShell fully functional.
To use the PowerShell remoting feature against your own machine, you need to enable PowerShell remoting on your machine. To do this, start PowerShell with full Administrator privileges, and run this command:
PS> Enable-PSRemoting -SkipNetworkProfileCheck -Force
Note that the parameter -SkipNetworkProfileCheck was introduced in PowerShell 3.0. If you are still using PowerShell 2.0, omit this parameter. You would then have to manually temporarily disable public network adapters if PowerShell complains about public network connections being present.
The command enables PowerShell remoting on your machine. Others can now connect to your computer, provided they are members of the Administrators group on your machine.
However, you would only be able to connect to others using Kerberos authentication. So at this point, remoting would only work for domain environments. If you operate a simple peer-to-peer network or want to use remoting across different domains, then enable NTLM authentication. Important: this is a setting that needs to be set on the client side: Not on the machine you want to connect to, but on the machine that you start your remote call:
PS> Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value * -Force
Using "*" allows you to contact any target machine via NTLM authentication. Since NTLM is a non-mutual authentication, NTLM can impose risks when you authenticate against a non-trusted and possibly compromised host. So instead of "*", you could also specify an IP address or the beginning of an IP address such as "10.10.*".
Once PowerShell remoting is set up, you can start to play.
This line would run arbitrary PowerShell code on the machine ABC (and requires that you first have enabled remoting on machine ABC and that you have Administrator privileges on ABC):
PS> Invoke-Command -ScriptBlock { "Hello" > c:\IwasHERE.txt } -ComputerName ABC
This would do the same, but here you would explicitly specify credentials. When you specify an account, always make sure you specify domain and username. If it is not a domain account, specify computer name and username:
Invoke-Command -ScriptBlock { "Hello" > c:\IwasHERE.txt } -ComputerName ABC -Credential ABC\localAdminAccount
Note: Domain-joined computers require the –Credential parameter whenever you want to use non-Kerberos authentication.
