I'm trying to find a way I can edit the 'trusted hosts' list under local group policy remotely. Path from within Local Group Policy is: \local computer policy\computer configuration\administrative templates\windows components\windows remote management(WindRM)\WinRM Client\trusted hosts

I can open the local group policy editor by doing this: gpedit.msc /gpcomputer: [IP of remote machine] From there I can add the additional trusted host but am looking for a way I can automate this using Powershell or Batch as have over 100 servers to do this for.

The server I am connecting FROM is already in the trusted hosts list of all client servers - I need to add a second one.

I've tried a few of ways so far: set-item wsman:[client-IP]\Client\TrustedHosts -value [trusted-IP]

set-item wsman:\[client-IP]\Client\TrustedHosts -value [trusted-IP]

set-item \[client-IP]\wsman\Client\TrustedHosts -value [trusted-IP]

neither of which work - I can't actually find any documentation about using 'wsman' remotely so not even sure I have the paths correct.

If doing this remotely is not a possibility does anyone know how to edit the local group policy (path to trusted hosts above) using a batch file as I can push the batch file out to all servers and have a scheduled task execute it.

Thanks for any help available.

EDIT: I've found, due to the way this has been previously setup in local group policy rather than through WINRM I am unable to edit this list using WSMAN - even locally.

I need to be able to edit the local group policy remotely, the only way I can currently think of it to write a batch file which can update the local group policy for me, push that out to all client servers and set a scheduled task to run the batch file.

I can't however, figure out how to edit local group policy from batch - anyone know of any documentation?

  • 1
    You say that you're doing this in the local Group Policy. Why aren't you doing this with domain Group Policy?
    – joeqwerty
    Feb 2 '16 at 16:59
  • 1
    'cos its not in a domain :)
    – lukester85
    Feb 3 '16 at 9:35
  • Wow. More than 100 servers and no AD. That sounds like a nightmare to manage.
    – joeqwerty
    Feb 3 '16 at 16:13
  • it can be, generally it's ok as i have a trusted host and a lot gets done via powershell from there. Just need to add an extra trusted host and I'll be all set. We are not in a domain because these are VPS's rented to 3rd parties. We just manage them (updates / patches etc) If there is a better way of doing this which i am missing I'm all ears!
    – lukester85
    Feb 4 '16 at 16:47

Try using WinRS from your workstation to invoke WinRM on the remote target with the new Trusted Host list. Works for me, but I don't have a workgroup only setup like yours to test that respect.

winrs -r:target.domain.com winrm set winrm/config/client @{TrustedHosts="*.domain.com,,localhost"}
winrs -r:target.domain.com -u:administrator -p:P4$$word winrm set winrm/config/client @{TrustedHosts="*.domain.com,,localhost"}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.