Step 14. Remote Management — Commanding a Computer Across the Network

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time 2 hours

Prerequisite: Step 13 complete. We will work in Windows PowerShell. Today is a conceptual-understanding chapter — hands-on remote-connection practice happens in Level 2, once a lab environment is in place.

• What you need: a Windows PC, PowerShell, Notepad (for the writing exercise in Section 3-6).
• Caution: this section’s exercises only query your own computer’s state, so they are read-only in the stated lab. Just remember one thing — practicing remote management only among your own computers in your own lab is an absolute rule of this book. Connecting to someone else’s computer without authorization is a crime, regardless of settings.

Corporate breach investigations often contain a twist. Examine the victim server’s logs, and the session that performed the malicious activity is recorded as having connected from another computer across the network. The intruder never sat in front of that server. How? The answer is simple — the attacker used the very same remote management features that administrators use every day. Today is the day we understand the structure of that “door.”

1. Learning Objectives

By the end of this unit, you will be able to:

• Explain what a remote session is, and the role and port numbers of WinRM/PSRemoting
• State the difference between Enter-PSSession and Invoke-Command
• Test whether a port (door) is open with Test-NetConnection and interpret the result
• Explain what lateral movement is and why legitimate management tools become its vehicle
• Produce a list of ports waiting (LISTENING) on your own computer

2. Background Knowledge — Today’s Tools and Concepts

This section’s Tools at a Glance

2-1. What a Remote Session Is

Until now, our PowerShell has been “a window inside my computer.” A remote session stretches this window’s cable across the network and connects it to another computer’s PowerShell. Your screen stays the same, but the commands execute on that computer over there.

It’s like sitting at home, phoning your office computer, and saying “print those documents for me.” Your hands are here; the work happens over there.

2-2. WinRM and PSRemoting — Windows’ Official Door

The official system that makes this possible on Windows is WinRM (Windows Remote Management), and the PowerShell-facing feature is called PSRemoting. It plays the same role as SSH on Linux (covered in Step 29).

Three important facts:

• WinRM commonly uses TCP 5985 for HTTP and TCP 5986 for HTTPS. HTTP does not imply unencrypted PowerShell message contents: supported authentication can provide message encryption after authentication.
• Listener availability varies by Windows edition and management policy. Inspect the actual service, listener, and firewall state rather than assuming a universal default.
• Connecting requires an account (ID/password) on the target computer — so that not just anyone can get in

2-3. Lateral Movement — The Attacker’s Sideways Walk

When an attacker first breaks into a corporate network, they usually take the weakest single machine (for example, the PC of an employee who opened a phishing email). But the prize (an important server) lies elsewhere. How do they get there?

From the compromised PC → to the PC next to it → to the next one → to the target server. This sideways walk is called lateral movement. And remote management features are one possible means of that movement — because they use legitimate functions already built into Windows rather than bringing hacking tools, detection is hard.

So the defender’s countermeasure is also fixed: record and monitor “who connected remotely, from where, to where.” Step 12’s logs reappear here — remote logins are all left as events, after all.

2-4. Credentials — The Key That Opens the Door

What remote access ultimately requires is an account. So instead of breaking down the door, attackers steal the key (account information). Real breaches often proceed in the order: “password leaked → remote access with a legitimate account → recorded in logs as a normal login.”

This is why password management is so emphasized, and why companies use separate administrator-only accounts — an isolation wall so that even if an everyday account falls to phishing, administrative rights don’t go with it. “Separate your privileges” — a recurring security design principle.

2-5. Why We Don’t Practice This Now

To actually try remote access, you need two computers: one that commands, one that receives. That’s why a “lab” is needed, and in Level 2 we’ll spin up several virtual machines and do it hands-on then. Today is the day to remember in your mind: “this kind of door exists, it works like this, and that’s why it’s dangerous.”

3. Follow Along

Before you begin. Ports 5985 and 5986 identify WinRM HTTP and HTTPS transports. With suitable authentication, WinRM can encrypt messages over HTTP too. Availability depends on Windows edition, listener configuration, policy, and firewall rules; it is not universally off by default.

3-1. Meeting Enter-PSSession Through the Help System

PowerShell ships with a built-in manual. Let’s meet this section’s star command through its help:

Get-Help Enter-PSSession

NAME
    Enter-PSSession

SYNOPSIS
    Starts an interactive session with a remote computer.

SYNTAX
    Enter-PSSession [-ComputerName] <string> [-Credential <pscredential>] [-Port <int>] ...
    Enter-PSSession [[-Session] <PSSession>] ...
    ...

Illustrative output. Values, wording, account names, and available fields vary by environment.

How to read it: the core form is this —

Enter-PSSession -ComputerName Server01 -Credential domainuser

“Open a remote session to the computer named Server01, with these credentials (account).” Once it runs, the prompt changes to something like [Server01]: PS>, and from then on every command you type executes on that computer over there.

Why do this: Get-Help is the tool you’ll reach for every time you meet an unfamiliar command from now on. A first-hand manual more accurate than an internet search already lives inside your computer. Add the -Examples option and it gathers up practical examples for you.

3-2. Invoke-Command — To Many Machines at Once

Let’s look at its cousin command:

Get-Help Invoke-Command -Examples

If Enter-PSSession is “converse with one machine,” Invoke-Command is the command that sprays “the same command to many machines at once”:

Invoke-Command -ComputerName S1, S2, S3 -ScriptBlock { Get-Service }

How to read it: “run Get-Service on the three machines S1, S2, S3, and gather the results for me.” This is the method an administrator uses to check the patch status of hundreds of machines.

Re-reading through the attacker’s eyes: what if this convenience lands in an attacker’s hands? It becomes “deploying a malicious command to many internal machines simultaneously.” Same tool, different intent — that sentence is this section’s core.

3-3. Testing Whether a Door Is Open — Test-NetConnection

Let’s test whether my computer’s WinRM door (port 5985) is open:

Test-NetConnection localhost -Port 5985

ComputerName     : localhost
RemoteAddress    : ::1
RemotePort       : 5985
TcpTestSucceeded : False

Illustrative output. Values, wording, account names, and available fields vary by environment.

TcpTestSucceeded: False means this TCP attempt did not establish a connection. Check the selected address, listener, and firewall. True establishes reachability at that instant, not the purpose or trustworthiness of the service.

Prediction exercise: test localhost port 443 and explain your own result. A local HTTPS listener may exist. This tests a port on your computer, not whether a remote website accepts HTTPS.

3-4. Viewing My Computer’s WinRM State

Get-Service WinRM | Select-Object Name, Status, StartType

Name   Status StartType
----   ------ ---------
WinRM Stopped    Manual

Illustrative output. Values, wording, account names, and available fields vary by environment.

WinRM is a service. Record Status and StartType as observed; defaults and organization policy vary. A running service alone does not prove a remotely reachable endpoint.

A security-awareness question: what if you’ve never configured remote management, yet this service shows Running + Automatic? That’s an investigation point — “who turned this on, and why?” On a company PC the IT department may have enabled it; otherwise, it’s grounds for suspicion. Knowing the history of your settings is where security begins.

3-5. Our House’s Door List — LISTENING Ports

Bringing back Step 6’s netstat. This time we look only at ports in the “waiting” (LISTENING) state:

netstat -an | Select-String LISTENING | Select-Object -First 10

  TCP    0.0.0.0:22             0.0.0.0:0              LISTENING
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:2869           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:3450           0.0.0.0:0              LISTENING
  ...

Illustrative output. Values, wording, account names, and available fields vary by environment.

A listening socket on 0.0.0.0 binds all local IPv4 interfaces. Port numbers suggest possible services; use the owning PID and service configuration to identify them. Reachability also depends on the network and firewall.

Why do this: the goal is not to understand everything but to build the habit of listing how many doors our house has and where. Only with this list in hand can you spot “a door that differs from usual.”

3-6. Organizing Your Thoughts — Writing One Paragraph

This section’s final exercise is not a command but writing. Open Notepad and write one paragraph answering this question in your own words:

“Why are remote management features (WinRM/PSRemoting) attractive to attackers?”

Hints: ① uses Windows’ built-in features with no additional tools to install (hard to detect), ② after compromising one machine, enables moving sideways with stolen accounts, ③ hard to distinguish from an administrator’s normal activity.

Why write it out: because the final verification of understanding is not execution but explanation. In interviews and in reports alike, this exact sentence gets used.

4. Missions & Exercises

Mission — An Inspection Checklist of My Computer’s Open Doors

Combine what you learned today into a checklist:

1. Check the result of Get-Service WinRM and record “on or off”
2. Test both Test-NetConnection localhost -Port 5985 and 5986, and record the results
3. Check the waiting ports with netstat -an | Select-String LISTENING
4. Gather all three into open-doors.txt, and on the last line write your answer to “Are there any open doors I don’t know about?”

Exercises

Question 1. What are the two ports WinRM waits on, and is this door’s default state open or closed?

Question 2. Explain the difference between Enter-PSSession and Invoke-Command, along with the situations where each is used.

Question 3. Give two or more reasons why an attacker would use legitimate features like WinRM instead of bothering to bring hacking tools.

Question 4. Answer practically: “If remote management is dangerous, why not just turn it all off?”

Get-Service WinRM | Select-Object Name, Status, StartType | Out-File open-doors.txt
Test-NetConnection localhost -Port 5985 -WarningAction SilentlyContinue |
  Format-List ComputerName, RemotePort, TcpTestSucceeded | Out-File open-doors.txt -Append
Test-NetConnection localhost -Port 5986 -WarningAction SilentlyContinue |
  Format-List ComputerName, RemotePort, TcpTestSucceeded | Out-File open-doors.txt -Append
netstat -an | Select-String LISTENING | Out-File open-doors.txt -Append
notepad open-doors.txt

WinRM: Stopped / Manual — off. I never configured this, so it is normal
5985: False / 5986: False — remote management doors are closed
LISTENING: 22 (SSH — do I know this?), 135, 445, 2869 (Windows defaults), 3450–3453 (need to check)
Answer: I need to verify that port 22 and the 3450-range belong to programs I installed

6. Common Pitfalls & Fixes

Wall 1. “I can’t practice remote access right now”

Symptom: you have only one computer at home, so there’s no counterpart to test Enter-PSSession against.
Cause: remote practice requires at least two machines — a perfectly normal situation.
Fix: today is a concept chapter, so having no practice is correct. In Level 2 you’ll spin up several virtual machines and practice to your heart’s content. For now, the one-paragraph explanation in Section 3-6 stands in for the exercise.

Wall 2. Get-Help output is too long

Symptom: the help scrolls on for dozens of screens.
Cause: it’s a formal manual, so it contains everything.
Fix: look at just -Examples, or pinpoint a single parameter you’re curious about, like Get-Help command -Parameter ComputerName. A manual is not a book you read front to back — it’s a dictionary you look things up in.

Wall 3. Test-NetConnection results differ from the textbook

Symptom: the book says False, but my computer says True.
Cause: some program enabled WinRM, or — on a company PC — it may be on by management policy.
Fix: this is not a malfunction but a discovery. Trace “who turned it on” — ask the IT department if it’s a company PC; if it’s a personal PC and you have no memory of it, it becomes practice in investigating when it was enabled, using the techniques from Steps 11–13.

Wall 4. Port numbers won’t stick in memory

Symptom: you confuse 5985 with 5895.
Cause: you’re trying to memorize. Port numbers are not a memorization subject.
Fix: even practitioners look up port numbers. What matters is not the number but the structure: “each service has a designated door, and open doors are inspection targets.” The numbers memorize themselves with use.

Wall 5. Too many LISTENING ports — it makes me anxious

Symptom: netstat shows a string of numbers you don’t know.
Cause: Windows holds several ports open by default (135, 445, etc.), and each installed program opens its own. The example computer had more than ten.
Fix: don’t be anxious — make a list. The goal is not “determine whether everything is normal right now” but “secure the usual list, and notice when something changes.” For unknown ports, trace the identity via OwningProcess → PID.

7. Summary

This section’s Concepts

This section’s Commands

A Sense That Matters More Than Commands

The door that is convenient for the administrator opens in exactly the same shape for an attacker holding stolen credentials. That is why recording and monitoring “who used this door” is the core of defense.

The security industry has an expression — “Living off the Land” — a technique of attacking using only the legitimate tools already present on the computer (PowerShell, WinRM), without bringing in malicious files. Abnormal use of normal files is hard for file-based antivirus to catch, which is why modern defense watches behavior — who ran what, when, and from where. The logs and lineage tracing you learned in Steps 12–13 are exactly the raw materials of that behavior-based defense.

And remote management is the first “perfect double-edged sword” you meet in this book. Turn it off and you can’t do your job; turn it on and it becomes the attacker’s road. Firewalls, encryption, access control… this dilemma will repeat across countless topics ahead, and each time the answer is not “off/on” but “control who uses it, when, and how.” The paragraph you wrote today is the very language of judgment a security professional uses every day.

Once every box is checked, Step 14 is complete.