Appendix A: Prerequisites for Enabling the Integrated Windows Gateway Mode

• Privlilege model (For IIS devices)
• Minimum privilege model (CA and Devices other than IIS)

# Get the username at runtime
$user = Read-Host "Enter the username"

# 1. Enable Authentication for WinRM
winrm set winrm/config/service/Auth '@{Basic="true"}'

# 2. Add the user to required local groups
net localgroup "Remote Management Users" /add $user
net localgroup "Performance Monitor Users" /add $user

# Check if "WinRMRemoteWMIUsers__" exists, if not create it
$groupName = "WinRMRemoteWMIUsers__"
$groupExists = Get-LocalGroup -Name $groupName -ErrorAction SilentlyContinue

if (-not $groupExists) {
    New-LocalGroup -Name $groupName -Description "WinRM Remote WMI Users"
}

# Add the user to the "WinRMRemoteWMIUsers__" group
Add-LocalGroupMember -Group $groupName -Member $user

# 3. Execute the 'winrm configSDDL default' command to configure permissions
Invoke-Expression -Command "cmd /c 'winrm configSDDL default'"

# Set permissions for the user (e.g., Read and Execute)
# Note: You would typically do this in the "winrm configSDDL default" command manually or via script 
# to allow Read (Get, Enumerate, Subscribe) and Execute (Invoke) for the specific user, but this may require elevated permissions.

# 4. Update Group Policy
gpupdate /force

Write-Host "User account setup complete. Please check the permissions in the WinRM configuration if needed."

# Prompt user for the certificate thumbprint
$newCertThumbprint = Read-Host "Enter the new certificate thumbprint"

# Keep asking for the IP address until it is not empty
$ip = ""
while (-not $ip) {
    $ip = Read-Host "Enter the IP address (this cannot be empty)"
    if (-not $ip) {
        Write-Host "IP address cannot be empty. Please enter a valid IP address."
    }
}

$port = "5986"  # Default port is always 5986
$ipport = $ip+":"+$port  # Combine IP and port into one variable
$hostname = ([System.Net.Dns]::GetHostByName(($env:computerName))).Hostname

# Show the existing certificate thumbprint associated with the WinRM HTTPS listener
$currentBinding = netsh http show sslcert ipport=$ipport

if ($currentBinding -like "*Certificate Hash*") {
    $currentCertThumbprint = ($currentBinding | Select-String -Pattern "Certificate Hash" | ForEach-Object { $_.Line.Split(':')[1].Trim() })
    Write-Host "Current certificate thumbprint: $currentCertThumbprint"
} else {
    Write-Host "No existing certificate bound to port: $port"
}

# Disassociate the existing certificate if a thumbprint is found
if ($currentCertThumbprint) {
    netsh http delete sslcert ipport=$ipport
    
    # Verify deletion
    $postDeleteBinding = netsh http show sslcert ipport=$ipport
    if ($postDeleteBinding -like "*The system cannot find the file specified*") {
        Write-Host "Successfully removed the certificate binding from port $port"
    } else {
        Write-Host "Failed to remove the certificate binding. Exiting."
        exit 1
    }
} else {
    Write-Host "No certificate found to disassociate."
}

# Delete the existing WinRM HTTPS listener
Write-Host "Deleting the existing WinRM HTTPS listener..."
winrm delete winrm/config/Listener?Address=*+Transport=HTTPS

# Add the new thumbprint to the WinRM config
Write-Host "Setting the new certificate thumbprint in WinRM configuration..."
winrm set winrm/config/service "@{CertificateThumbprint=`"$newCertThumbprint`"}"

# Create a new listener and associate the new certificate with the specified port
Write-Host "Creating a new listener and binding the new certificate to port $port..."
$appId = [guid]::NewGuid().ToString()  # Generate a random app GUID
netsh http add sslcert ipport=$ipport certhash=$newCertThumbprint appid="{$appId}"

# Create the new listener using WinRM
New-Item -Path WSMan:\Localhost\Listener -Transport HTTPS -Address * -CertificateThumbprint $newCertThumbprint -HostName $hostname -Force

# Verify the new binding
$finalBinding = netsh http show sslcert ipport=$ipport
if ($finalBinding -like "*Certificate Hash*") {
    Write-Host "New certificate bound to port $port successfully."
} else {
    Write-Host "Failed to associate the new certificate."
    exit 1
}