Advanced - Attributes
Analyser (Command Line Parameters)
Analyser (Program Roles)
Analysis Functions (Functions)
Attributes (Advanced)
Automatic Protocol Determination (Connections)


Built-In Layouts - General
Built-In Layouts - Hyper-V
Built-In Layouts - Overview


Chart (Elements)
Charts (Interactive Elements)
Collecting Data (Concepts)
Collector (Program Roles)
Collector (Unattended Installation)
Combination Operators (Operators)
Command Line Parameters - Analyser
Command Line Parameters - Configurator
Command Line Parameters - Deployer
Command Line Parameters - Inspector
Command Line Parameters - Installation
Command Line Parameters - Watcher
Comparison Operators (Operators)
Concepts - Collecting Data
Concepts - Layouts
Concepts - Overview
Concepts - Presenting Information
Configurator (Command Line Parameters)
Configurator (Program Roles)
Connection Methods (Connections)
Connection Methods (Data Acquisition)
Connections - Automatic Protocol Determination
Connections - Connection Methods
Constrain (Functions)
Context Menus (Information Display)
Conversion Functions (Functions)
Count (Functions)
Custom Filename Format Substitutions (Image Capture)


Data Acquisition - Connection Methods
Data Acquisition - System Queries
Data Collection - Excluded Instances
Data Collection - System Impact
Data Types (Expressions)
Data Value (Variables)
Date Functions (Functions)
Date Functions (Functions)
Day (Functions)
DayOfWeek (Functions)
DayOfYear (Functions)
Decision Functions (Functions)
Deployer (Command Line Parameters)
Deployer (Program Roles)
Display Updates (Information Display)
Displaying Relevant Information (Layout Design)
Drill Down (Information Display)


Elements - Chart
Elements - Event List
Elements - Gauge
Elements - Group
Elements - Image
Elements - Label
Elements - LCD Matrix
Elements - Overview
Elements - Process List
Elements - Service List
Elements - Status Indicator
Elements - Thread List
Event List (Elements)
Event List (Variables)
Event Logs (Interactive Elements)
Excluded Instances (Data Collection)
Expressions - Data Types
Expressions - Functions
Expressions - Operators
Expressions - Overview
Expressions - Overview
Expressions - Variables
Extracting Information (Information Display)


FormatDynamicInstance (Functions)
Formatting Functions (Functions)
Functions - Analysis Functions
Functions - Constrain
Functions - Conversion Functions
Functions - Count
Functions - Date Functions
Functions - Date Functions
Functions - Day
Functions - DayOfWeek
Functions - DayOfYear
Functions - Decision Functions
Functions - FormatDynamicInstance
Functions - Formatting Functions
Functions - Hour
Functions - If
Functions - Instr
Functions - Instr
Functions - IsConvertible
Functions - IsDefined
Functions - IsNull
Functions - IsType
Functions - LCase
Functions - Left
Functions - Len
Functions - Max
Functions - Mid
Functions - Min
Functions - Minute
Functions - Month
Functions - ReplaceError
Functions - Right
Functions - Second
Functions - SmartFormat
Functions - String Functions
Functions - TimeSpan
Functions - ToBoolean
Functions - ToDate
Functions - ToFloat
Functions - ToInteger
Functions - ToString
Functions - Trim
Functions - UCase
Functions - Year
Functions (Expressions)


Gateway (Program Roles)
Gauge (Elements)
Gauges (Interactive Elements)
General (Built-In Layouts)
Group (Elements)
Grouping Information (Layout Design)


Hour (Functions)
Hyper-V (Built-In Layouts)


If (Functions)
Image (Elements)
Image Capture - Custom Filename Format Substitutions
Information Display - Context Menus
Information Display - Display Updates
Information Display - Drill Down
Information Display - Extracting Information
Information Display - Keyboard Navigation
Information Display - Sizing
Inspector (Command Line Parameters)
Inspector (Program Roles)
Installation (Command Line Parameters)
Instr (Functions)
Instr (Functions)
Interactive Elements - Charts
Interactive Elements - Event Logs
Interactive Elements - Gauges
Interactive Elements - Lists
Interactive Elements - Processes
Interactive Elements - Services
IsConvertible (Functions)
IsDefined (Functions)
IsNull (Functions)
IsType (Functions)


Keyboard Navigation (Information Display)


Label (Elements)
Layout Design - Displaying Relevant Information
Layout Design - Grouping Information
Layout Design - Managing Layouts
Layout Design - Modifying Layouts
Layout Design - Navigation Within A Layout
Layout Design - Overview
Layout Design - Sizing And Positioning Elements
Layout Management - Overriding The Built-In Layouts
Layouts (Concepts)
LCase (Functions)
LCD Matrix (Elements)
Left (Functions)
Legal Information
Len (Functions)
List Count (Variables)
List Selection (Variables)
Lists (Interactive Elements)
Logical Operators (Operators)


Managing Layouts (Layout Design)
Max (Functions)
Mid (Functions)
Min (Functions)
Minute (Functions)
MMC SnapIn (Program Roles)
Modifying Layouts (Layout Design)
Month (Functions)


Navigation Within A Layout (Layout Design)


Operators - Combination Operators
Operators - Comparison Operators
Operators - Logical Operators
Operators - Unary Operators
Operators (Expressions)
Operators (Precedence)
Overriding The Built-In Layouts (Layout Management)
Overview (Built-In Layouts)
Overview (Concepts)
Overview (Elements)
Overview (Expressions)
Overview (Expressions)
Overview (Layout Design)
Overview (Technical Reference)
Overview (Usage)


Parentheses (Precedence)
Performance Item (Variables)
Precedence - Operators
Precedence - Parentheses
Presenting Information (Concepts)
Process List (Elements)
Process List (Variables)
Processes (Interactive Elements)
Program Roles - Analyser
Program Roles - Collector
Program Roles - Configurator
Program Roles - Deployer
Program Roles - Gateway
Program Roles - Inspector
Program Roles - MMC SnapIn
Program Roles - Screensaver
Program Roles - Watcher


ReplaceError (Functions)
Right (Functions)


Screensaver (Program Roles)
Second (Functions)
Series Aggregation (Variables)
Service List (Elements)
Service List (Variables)
Services (Interactive Elements)
Sizing (Information Display)
Sizing And Positioning Elements (Layout Design)
SmartFormat (Functions)
Standard (Variables)
Status Indicator (Elements)
String Functions (Functions)
System (Variables)
System Impact (Data Collection)
System Queries (Data Acquisition)
System Variables (Variables)


Technical Reference - Overview
Thread List (Elements)
Thread List (Variables)
TimeSpan (Functions)
ToBoolean (Functions)
ToDate (Functions)
ToFloat (Functions)
ToInteger (Functions)
ToString (Functions)
Trim (Functions)


UCase (Functions)
Unary Operators (Operators)
Unattended Installation - Collector
Usage - Overview


Variables - Data Value
Variables - Event List
Variables - List Count
Variables - List Selection
Variables - Performance Item
Variables - Process List
Variables - Series Aggregation
Variables - Service List
Variables - Standard
Variables - System
Variables - System Variables
Variables - Thread List
Variables (Expressions)


Watcher (Command Line Parameters)
Watcher (Program Roles)


Year (Functions)

Connections - Connection Methods

When connecting to a computer, ServerInternals can connect to a Collector service, to the operating system itelf, or indirectly via a gateway. When connecting directly to the operating system, ServerInternals can use either WinRM (Windows Remote Management) or WMI (Windows Management Instrumentation), with WinRM split into normal and secure variants. There are significant differences in the connection requirements for the two protocols.

Collector Service

The Collector is an optional service that provides unattended data collection, so that the user interface can display historic trending information. It listens on a single configurable TCP port and uses the Windows SSPI providers to authenticate connections from workstations and to encrypt all data sent over the network.

There is no requirement to install the Collector – the user interface will display current information gathered over the network using one of the remote management protocols, and will display full diagnostic information for instantaneous performance values, performance charts, event log details, service status and process lists, but without the Collector, the performance charts will only show data from the point when the connection was made to the server. Because the Collector is running all the time, it captures performance data continuously and this can then be used to populate historic data on the performance charts in the user interface.

WinRM And WinRM (Secure)

The two variants of WinRM only require an outbound connection on a single TCP port, and so are much more suitable for connections to remote systems that must traverse firewalls. Normal WinRM connects on port 5985 and the secure variant connects on port 5986. Once connected, the two provide identical functionality - the difference is in how the connection is established and the checks made as part of connection setup.

For normal WinRM, the initial SOAP header is sent unencrypted, but all subsequent traffic is encrypted. However, there is no guarantee that the computer intended as the connection target is the one to which the traffic is sent, and normal WinRM makes no attempt to validate the target computer.

Secure WinRM addresses both the encryption and computer identification issues. A certificate is installed on the target computer, and WinRM is configured to listen on a secure connection, using this certificate. The certificate must be a "Server Authentication" certificate with a common name that matches the hostname, and it must not be expired, revoked or self-signed. Once a suitable certificate is installed on the target computer, the following command will configure WinRM to support secure inbound connections:

winrm quickconfig -transport:https

When connecting using secure WinRM, ServerInternals will only establish the connection if the certificate is valid, trusted and matches the name of the computer to which a connection was requested. Furthermore, all traffic, including the SOAP header, is encrypted.

Note that the default installations of Windows do not include a suitable certificate, and one must be obtained from an appropriate source and manually installed before connections over secure WinRM will be possible.

When connecting to a remote system in a different domain using normal WinRM, the WinRM implementation requires an entry in the TrustedHosts list of the client computer. If running with elevated local administrative authority, ServerInternals will maintain the TrustedHosts list automatically. However, if not running under administrative elevation, it will not be possible to maintain the list and if the target computer is not on the list, the connection will fail. It is possible to manually add hosts to the TrustedHosts list by running the command

winrm set winrm/config/client '@{TrustedHosts="firstcomputer,secondcomputer")'

from an elevated command prompt.


WMI uses DCOM as an underlying protocol. DCOM uses dynamic port assignments and incorporates inbound traffic from the target computer on these dynamic ports. This makes the protocol unsuitable for use through most firewalls. It is not recommended that the WMI protocol is used to connect to any system not on the main corporate network. For Server 2008 R2 and earlier, WinRM is not automatically enabled, and so for some scenarios, WMI may be a more appropriate choice when connecting to systems running those operating systems.


The gateway runs under Internet Information Services, and acts as a proxy between the collector and the user interface, facilitating an indirect connection between the two. The collector publishes information to the gateway, and this information is then passed on to the user interface when that connects to the gateway itself. In this way, the user interface can display system information for a server that is not directly accessible.

Typically, the gateway is installed on an internet-facing server, in order to provide access to systems that are behind a firewall from the public internet. It is not required when using ServerInternals exclusively within a corporate network.