Enable Server Manager remote management for Windows Server 2016 Core

• Author
• Recent Posts

Robert Pearman

Robert is a small business specialist from the UK and currently works as a system administrator. He was a Microsoft MVP for eight years and has worked as a technical reviewer for Microsoft Press. You can follow Robert on Twitter and in his blog.

Latest posts by Robert Pearman (see all)

• Run Exchange Online commands using Azure Automation - Tue, Jul 25 2023
• Connect to Exchange Online with PowerShell and certificate-based authentication - Wed, Jul 19 2023
• Office Deployment Tool (ODT): Deploy Office using custom XML files - Thu, Mar 30 2023

The GUI server is my production Hyper-V host, and I wanted to use Server Manager to keep an eye on the lab server. There are many, many guides on this out there. However, what I found since the last time I did this was that something is always missing from my notes or the posts I am trying to follow. For example, I had the server showing up and populated correctly in Server Manager, but I was unable to view the storage.

First off, I'll assume you have completed the installation of the operating system. Once logged in, you will see the SConfig tool. Here, our goal is to configure Windows Remote Management (WinRM) to work over HTTPS. First, we have to enable Remote Desktop.

Choose option 7 (Remote Desktop) and then press E to enable it.

SConfig menu on Server Core

When asked which authentication method to enable, choose option 1.

SConfig menu option 7

You should then see a message box indicating it has enabled Remote Desktop.

SConfig menu enabling Remote Desktop

Now you can Remote Desktop to your Core server if you wish.

Once logged in, select the cmd window floating in the background. Enter this command:

winrm e winrm:config:listener

This will show you the current listeners configured by WinRM.

Check WinRM listener

You can see we just have one listener enabled using the default HTTP.

Type PowerShell and press Enter.

Run this command:

get-childitem cert:\localmachine\my

Check local certificates

You should receive no output for this, and this means you have no certificates installed on the machine.

Using this post as a guide, we can set up a self-signed certificate and assign it to a WinRM listener.

New-SelfSignedCertificate -DnsName hyper-v-host.sbs.local ‑CertStoreLocation cert:\localmachine\my
New-SelfSignedCertificate

Now this certificate is self-signed, so our GUI server won't trust it. We will need to install this certificate on our GUI server. Make a note of the thumbprint from your new certificate, as we will need that in our next command.

First, we can store our certificate in a variable.

$cert = get-childitem cert:\localmachine\my | where { $_.ThumbPrint -eq "E941D147E708A1EA04EEA8E48B7A88328B5AC47D" }

We need to protect our certificate with a password, which we need to store as a secure string.

$password = ConvertTo-SecureString P@ssw0rd -AsPlainText –Force

Now we can export our certificate.

$cert | Export-PfxCertificate -FilePath c:\hyper-v-host.pfx -Password $password

Export certificate

We can collect that file later and then install it on our GUI server.

Now we need to set up our WinRM HTTPS listener. Switch back to cmd.

The command we need to enter is quite long and needs two pieces of information: your server's fully qualified domain name (FQDN) and the thumbprint of the certificate we just generated.

winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="hyper-v-host.sbs.local"; CertificateThumbprint="E941D147E708A1EA04EEA8E48B7A88328B5AC47D"}

New HTTPS listener

Now we can run our first WinRM command and make sure our listener is enabled.

winrm e winrm/config/listener

We can see here we now have two listeners enabled.

Show HTTPS listeners

Moving over to our GUI server, we need to configure some things before we can connect to the Core server.

We need to store the password for the Core server's built-in Administrator account in the credential store.

Open a PowerShell window and enter the following:

cmdkey /add:hyper-v-host /user:administrator /pass:P@ssw0rd
cmdkey /add:hyper-v-host.sbs.local /user:administrator /pass:P@ssw0rd

Save credentials

Notice we have saved the credential for the hostname and the FQDN.

Next we can add the Core server as a trusted host.

set-item wsman:\localhost\client\trustedhosts -Value hyper-v-host ‑Concatenate
set-item wsman:\localhost\client\trustedhosts -Value hyper-v-host.sbs.local ‑Concatenate

Add trusted host

Again we add both the hostname and the FQDN.

We can now use PowerShell remoting to connect to our Core server, which is lucky since we need to do a couple of other bits. We need to configure the firewall for file and print sharing, allow remote access for local accounts, and enable remote firewall management.

Enter-PSSession HYPER-V-HOST
New-ItemProperty -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name LocalAccountTokenFilterPolicy -Value 1 -Type DWORD
netsh advfirewall set currentprofile settings remotemanagement enable
netsh advfirewall set rule group="File and Printer Sharing" new enable=Yes

Edit the registry

We can now browse the folders on our Core server.

If we open the c$ share, we can get our certificate and install it.

Right-click the PFX file and follow the Certificate Import Wizard to install the certificate into the Trusted Root Certificate Authorities for the local machine.

Import PFX

Trusted Root Certificate Authorities store

We should now have done enough to get Server Manager able to manage our Core server remotely.

Open Server Manager and choose option 3 to add other servers.

Server Manager

Choose the DNS tab and enter the name of your Core server.

Use the arrow to add it to the list of selected computers and click OK. Server Manager will add the server.

Adding a server

Move to All Servers and we can see our server listed.

Server online

You should see Online in the Manageability column, and that's all there is to it.