| name | windows-remote-management |
| description | Use when diagnosing WinRM, CIM, PowerShell remoting, SSH, RDP health, authentication, trust, delegation, or constrained endpoints; use windows-network-admin for network-path failures. |
| metadata | {"portable":true,"compatible_with":["claude-code","codex"]} |
Windows Remote Management
Use when
- WinRM/CIM/PowerShell remoting transport or authentication fails.
- Choose a local, domain, workgroup, SSH, JEA, WAC, or API boundary.
- Record session identity, delegation, encryption, timeout, and endpoint policy.
Do not use when
- DNS, route, listener, or firewall reachability is not yet proved.
- The request is to retrieve or expose credentials.
Inputs
Canonical target, source host, transport, authentication method, endpoint,
trust evidence, identity, expected command, timeout, and disconnect recovery.
Platform and privilege boundary
Diagnostics are R0. Enabling/configuring remoting, firewall, trusted hosts,
CredSSP, delegation, certificates, or endpoints is R3/R4 and blocked in 0.1.
Workflow
- Prove network path and target identity.
- Inspect listener, service, endpoint, certificate, authentication, and policy.
- Distinguish transport, authentication, authorisation, delegation, and command failure.
- Prefer Kerberos in a correctly configured domain; never broaden TrustedHosts
as a generic fix.
- Use JEA or a constrained endpoint when a narrow task can replace broad admin.
Mutation, verification, and recovery
Any configuration change needs preview, out-of-band access, timed recovery, and
a new session verification from the original source. Existing session survival
does not prove future access.
Stop conditions
Stop on identity mismatch, certificate failure, unapproved delegation, workgroup
trust ambiguity, inaccessible recovery path, or cross-tenant uncertainty.
Capability contract and degraded mode
Read diagnostics only by default. Without both ends of the connection, produce
a two-sided collection plan and leave cause unassessed.
Outputs
Session-boundary record, layered failure classification, endpoint/policy state,
tested command outcome, disconnect risk, and recovery proof.
Decision rules
| Condition | Action |
|---|
| TCP path fails | Return to network skill |
| Kerberos SPN/time/DNS mismatch | Route to AD health |
| Broad admin only for one task | Design JEA endpoint |
| Workgroup trust unresolved | Block mutation |
Quality standards
Record who executed what on which canonical target through which protected
transport. Never use successful session creation as workload verification.
Anti-patterns
- Adding
* to TrustedHosts. Fix: establish identity/trust.
- Enabling CredSSP casually. Fix: justify delegation risk.
- Reusing hidden sessions. Fix: record explicit session identity.
- Testing only locally. Fix: verify from source host.
- Returning credential material. Fix: use approved secret provider references.
References
