Powershell Commands to enable remote management on Server 2016 Core

Question

_{Wednesday, March 29, 2017 9:44 PM}

Hey All,

This is probably my biggest pet peeve with core. We all know core is slim with no GUI. We all know you usually remotely manage Core services via RSAT or Web Client, or whatever else the particular services being implemented on core might be. It's nice that the service itself is allowed remotely. However it be nice if there was a Group (I guess in this case a DisplayGroup since the "Group" as listed under AdvFirewall Snap-in is actually DisplayGroup under the objects attributes instead of Group, same thing goes for the Name column, you have no idea how much I hate that.) that could enable RSAT snap-in to connect to core services (Adv Firewall Snap-in, Comp Mgmt, Disk Mgmt, etc)

Took long enough to find a decent blog that showed the proper PowerShell command to enable the existing rule for ICMPv4-in vs making a new rule (which seem to be the most common answer for applying ICMP via CMD)

"Set-NetFirewallRule -DisplayName “File and Printer Sharing (Echo Request – ICMPv4-In)” -enabled True"

Source

However the other remote management requirements are not so easy to determine. Many say enable group "Remote Administration" which running Get-NetFirewallRule | FT DisplayGroup, clearly shows no such group exists.

Looking through the list I saw Windows Remote Management Group, enabling that group still didn't allow my RSAT Snap-ins to connect successfully.

What is the Powershell command to allow all remote management of my core server via RSAT?!?!?!

All replies (14)

_{Wednesday, March 29, 2017 9:58 PM}

Interesting Enough, under sconfig, then 4) configure remote management. There's an option 3 to enable server response to Ping.

That's nice! However even selecting 1) Enable Remote Management didn't work for Device Manager snap-in to work. I even disabled the firewall completely and surprisingly Task Scheduler worked no prob, Event Viewer worked no prob, Local User and Groups also opened up without issue.... Yet I still get access denied when I attempt to open Device Manager Snap-in and point it to the remote system... what did I miss?

mmmmm.... I'm assuming this...

http://www.briandesmond.com/blog/using-device-manager-remotely

Uhhhhhhhhhh!!!!

_{Thursday, March 30, 2017 4:18 PM}

I reviewed this:

https://technet.microsoft.com/en-us/library/jj574205(v=ws.11).aspx

Which was updated for Server 2012. It's nice to see Group names change :S

E.G. Remote Services Management (2008) = Remote Service Management (2012 and up) 
Seriously Why?!?!? Services made more sense and didn't require a change...

The link provided still states the following powershell command:

"Enable-NetFirewallRule -DisplayGroup "Remote Administration""

I have tested the command in server core 2016 and it does not work. All sub groups seem to be working however.

_{Thursday, April 6, 2017 8:14 PM}

Anyone have insight when MS will update their documents on managing Server Core 2016?

_{Monday, April 24, 2017 3:42 AM}

Hi Zewwy,

Thanks for post here and sorry for the late reply.

>>Anyone have insight when MS will update their documents on managing Server Core 2016?

Please post a feedback on link below:

https://windowsserver.uservoice.com/forums/295047-general-feedback

Besides, we could try to use powershell related commands or "server manager" to manager the server core.

Best regards,

Andy

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Monday, June 12, 2017 6:04 PM}

Thanks for the reply Andy,

The problem is remotely managing newly created Core servers. Such that you can "Configure Remote Management" option via sconfig, but this isn't good enough to get lots of MMC Snap-ins to work. E.G Firewall snap-in. While it does allow the Services Snap-in to work.

Other than that you can enable Remote Desktop, and do an RDP session and run commands or PowerShell Cmdlet  natively.

So back in 2012 there was a known "Remote Administration" to allow opening of all required ports for all remote snap-ins to work. I annoyance is the removal of this group to easy open rules required to do remote administrative work.

Otherwise "Server Manager" Seems to work for most things. Same common things apply like Device Manager not being able to be access, needs a GPO setting which AFAIK isn't even configurable anymore on 2016+ servers.

Just the way it is I guess. Thanks

_{Friday, October 20, 2017 2:36 PM | 3 votes}

I didn't use PS, but netsh. I'm sure, given time, a similar PS command could be grokked.

1. netsh firewall set service type=remoteadmin mode=enable

This created the missing Remote Administration group. You'll get a depreciation warning.

2. netsh advfirewall firewall set rule group="remote administration" new enable=yes

This updated (on my machine) 3 firewall rules.

I still don't have Device Manager or Disk Management, but mostly everything else is working now.

Note: Expanding the Task Scheduler node in Computer Management causes a flood of error dialogs. Something is broken with all the XML for Task Scheduler.

Pete Wason

_{Wednesday, December 20, 2017 8:21 PM}

Thanks guy. Indeed I have seen those, I'll play around and see if this group magically gets created, why it was removed to begin with is rather annoying.

And yes Disk Managment requires VDS service to be started (its not started by deafult and needs to be enabled "net start vds" and "sc config vds start=auto" to set it to start from boot.

Compmgmt requires even more garbage and from what I remember it still doesn't work very well, better to use server manager for these type of tasks (what I found from playing around) Seems MMC snap-ins are going the way of the dodo bird.

I'm more than willing to start playing with honululu but I have no clue how it'll handle older servers...

_{Friday, February 23, 2018 10:57 PM | 8 votes}

To enable remote management on a new server 2016 core install I run the following PowerShell commands:

Enable-PSRemoting

Enable-NetFirewallRule -DisplayName "Windows Management Instrumentation (DCOM-In)"
Enable-NetFirewallRule -DisplayGroup "Remote Event Log Management"
Enable-NetFirewallRule -DisplayGroup "Remote Service Management"
Enable-NetFirewallRule -DisplayGroup "Remote Volume Management"
Enable-NetFirewallRule -DisplayGroup "Windows Firewall Remote Management"
Enable-NetFirewallRule -DisplayGroup "Remote Event Log Management"
Enable-NetFirewallRule -DisplayGroup "Remote Scheduled Tasks Management"

After running those, I'm able to do everything I need to do.

Note that Microsoft has change the Remote Firewall Display Group in the new Windows Server 1709. The new command is:

Enable-NetFirewallRule -DisplayGroup "Windows Defender Firewall Remote Management"

Go Microsoft...

_{Saturday, March 3, 2018 12:16 AM}

Thanks for that additional info! I'll play around in my labs to verify the results.

Thanks again for contributing!

_{Sunday, August 19, 2018 10:05 PM}

Great, work perfectly.

Thanks

_{Saturday, August 3, 2019 4:02 PM}

Works great thanks!

_{Monday, October 28, 2019 2:15 AM}

I am trying all of those and all give me an error:

No MSFT_NetFirewallRule objects found

I am using Windows Server 2019 core

_{Monday, October 28, 2019 7:52 PM}

Hi Tom,

Did you try the command that work in 1709?

Enable-NetFirewallRule -DisplayGroup "Windows Defender Firewall Remote Management"

We don't have 2019 Core, but that works in 2019 with the GUI.

_{Monday, October 28, 2019 7:54 PM}

I found the other way. I installed FOD and modified rules via local mmc