Connections - Connection Methods

When connecting to a computer, ServerInternals can connect to a Collector service, to the operating system itelf, or indirectly via a gateway. When connecting directly to the operating system, ServerInternals can use either WinRM (Windows Remote Management) or WMI (Windows Management Instrumentation), with WinRM split into normal and secure variants. There are significant differences in the connection requirements for the two protocols.

Collector Service

The Collector is an optional service that provides unattended data collection, so that the user interface can display historic trending information. It listens on a single configurable TCP port and uses the Windows SSPI providers to authenticate connections from workstations and to encrypt all data sent over the network.

There is no requirement to install the Collector – the user interface will display current information gathered over the network using one of the remote management protocols, and will display full diagnostic information for instantaneous performance values, performance charts, event log details, service status and process lists, but without the Collector, the performance charts will only show data from the point when the connection was made to the server. Because the Collector is running all the time, it captures performance data continuously and this can then be used to populate historic data on the performance charts in the user interface.

WinRM And WinRM (Secure)

The two variants of WinRM only require an outbound connection on a single TCP port, and so are much more suitable for connections to remote systems that must traverse firewalls. Normal WinRM connects on port 5985 and the secure variant connects on port 5986. Once connected, the two provide identical functionality - the difference is in how the connection is established and the checks made as part of connection setup.

For normal WinRM, the initial SOAP header is sent unencrypted, but all subsequent traffic is encrypted. However, there is no guarantee that the computer intended as the connection target is the one to which the traffic is sent, and normal WinRM makes no attempt to validate the target computer.

Secure WinRM addresses both the encryption and computer identification issues. A certificate is installed on the target computer, and WinRM is configured to listen on a secure connection, using this certificate. The certificate must be a "Server Authentication" certificate with a common name that matches the hostname, and it must not be expired, revoked or self-signed. Once a suitable certificate is installed on the target computer, the following command will configure WinRM to support secure inbound connections:

winrm quickconfig -transport:https

When connecting using secure WinRM, ServerInternals will only establish the connection if the certificate is valid, trusted and matches the name of the computer to which a connection was requested. Furthermore, all traffic, including the SOAP header, is encrypted.

Note that the default installations of Windows do not include a suitable certificate, and one must be obtained from an appropriate source and manually installed before connections over secure WinRM will be possible.

When connecting to a remote system in a different domain using normal WinRM, the WinRM implementation requires an entry in the TrustedHosts list of the client computer. If running with elevated local administrative authority, ServerInternals will maintain the TrustedHosts list automatically. However, if not running under administrative elevation, it will not be possible to maintain the list and if the target computer is not on the list, the connection will fail. It is possible to manually add hosts to the TrustedHosts list by running the command

winrm set winrm/config/client '@{TrustedHosts="firstcomputer,secondcomputer")'

from an elevated command prompt.

WMI

WMI uses DCOM as an underlying protocol. DCOM uses dynamic port assignments and incorporates inbound traffic from the target computer on these dynamic ports. This makes the protocol unsuitable for use through most firewalls. It is not recommended that the WMI protocol is used to connect to any system not on the main corporate network. For Server 2008 R2 and earlier, WinRM is not automatically enabled, and so for some scenarios, WMI may be a more appropriate choice when connecting to systems running those operating systems.

Gateway

The gateway runs under Internet Information Services, and acts as a proxy between the collector and the user interface, facilitating an indirect connection between the two. The collector publishes information to the gateway, and this information is then passed on to the user interface when that connects to the gateway itself. In this way, the user interface can display system information for a server that is not directly accessible.

Typically, the gateway is installed on an internet-facing server, in order to provide access to systems that are behind a firewall from the public internet. It is not required when using ServerInternals exclusively within a corporate network.