title: Configure WinRM over HTTPS on Multiple Computers with Powershell
body: <p>Configure WinRM over HTTPS on Multiple Computers with Powershell</p>
  <p>I have the following script that I put together to configure WinRM over HTTPS and it works great on per machine. I am having a tough time recoding it to run remotely on multiple machines located in a text file.</p>
  <p>Also as a bonus, i would like some kind of logging and checking in place for machines that fail or bring back any type of errors.</p>
  <p>Any help would be greatly appreciated.</p>
  <pre><code>$user = &quot;Account to Use - Service Account Suggested&quot;
  $Certname = &quot;HOSTNAME FQDN&quot;
  $Cert = New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname $Certname
  $pw = ConvertTo-SecureString -String &quot;Pazzword&quot; -Force -AsPlainText
  $thumbprint = $Cert.Thumbprint
  WinRM e winrm/config/listener
  #winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=&quot;$Certname&quot;; CertificateThumbprint=$thumbprint}'
  New-Item WSMan:\localhost\Listener -Address * -Transport HTTPS -HostName $Certname -CertificateThumbPrint $thumbprint
  $port=5986
  netsh advfirewall firewall add rule name=&quot;Windows Remote Management (HTTPS-In)&quot; dir=in action=allow protocol=TCP localport=$port
  net localgroup &quot;Remote Management Users&quot; /add $user
  net localgroup &quot;Event Log Readers&quot; /add $user
  Restart-Service WinRM
  Restart-Service Winmgmt -Force
  
  
  #Adding the below script should replace &quot;winrm configSDDL default&quot;
  $GENERIC_READ = 0x80000000
  $GENERIC_WRITE = 0x40000000
  $GENERIC_EXECUTE = 0x20000000
  $GENERIC_ALL = 0x10000000
  
  # get SID of user/group to add
  
  $user_sid = (New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList $user).Translate([System.Security.Principal.SecurityIdentifier])
  
  # get the existing SDDL of the WinRM listener
  $sddl = (Get-Item -Path WSMan:\localhost\Service\RootSDDL).Value
  
  # convert the SDDL string to a SecurityDescriptor object
  $sd = New-Object -TypeName System.Security.AccessControl.CommonSecurityDescriptor -ArgumentList $false, $false, $sddl
  
  # apply a new DACL to the SecurityDescriptor object
  $sd.DiscretionaryAcl.AddAccess(
  [System.Security.AccessControl.AccessControlType]::Allow,
  $user_sid,
  ($GENERIC_READ -bor $GENERIC_EXECUTE),
  [System.Security.AccessControl.InheritanceFlags]::None,
  [System.Security.AccessControl.PropagationFlags]::None
  )
  
  # get the SDDL string from the changed SecurityDescriptor object
  $new_sddl = $sd.GetSddlForm([System.Security.AccessControl.AccessControlSections]::All)
  
  # apply the new SDDL to the WinRM listener
  Set-Item -Path WSMan:\localhost\Service\RootSDDL -Value $new_sddl -Force```
  </code></pre>