Manage Windows Servers from Linux with WinRM or SSH

You can run commands on a Windows server from a Linux terminal without ever opening a remote desktop. There are two good ways to do it: Windows Remote Management (WinRM), the protocol behind classic PowerShell remoting, and OpenSSH, which current Windows Server versions include. This guide shows how to set up each one securely, run commands from Linux with Python or PowerShell 7, and fix the usual connection errors.

1. WinRM, SSH or RDP?

From Linux, SSH is usually the simplest choice for a shell, because PowerShell 7 on Linux does not support the WinRM transport for Enter-PSSession; it uses SSH instead. WinRM remains the standard for Python scripts and for Ansible's classic Windows connection.

2. Enable WinRM over HTTPS on the Windows server

WinRM is present on every current Windows Server. Open PowerShell as Administrator on the server and run:

# Turn on PowerShell remoting (creates the HTTP listener and firewall rules)
Enable-PSRemoting -Force

# Create an HTTPS listener. Use a certificate from your CA whose name matches the server;
# a self-signed one is acceptable only in a lab.
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*server.example.com*" } | Select-Object -First 1
New-Item -Path WSMan:\localhost\Listener -Transport HTTPS -Address * `
  -CertificateThumbPrint $cert.Thumbprint -HostName "server.example.com" -Force

# Allow 5986 only from your management IP address
New-NetFirewallRule -Name "WinRM-HTTPS-In" -DisplayName "WinRM over HTTPS" `
  -Direction Inbound -Protocol TCP -LocalPort 5986 -RemoteAddress 198.51.100.20 -Action Allow

# Check the listeners
winrm enumerate winrm/config/listener

Once HTTPS works, you can remove the HTTP listener, or limit its firewall rule to your internal network. Replace 198.51.100.20 with your own static IP address.

3. Run commands from Linux with pywinrm

Modern Debian and Ubuntu releases block system-wide pip installs, so use a virtual environment:

python3 -m venv ~/winrm-env
source ~/winrm-env/bin/activate
pip install pywinrm            # add [kerberos] or [credssp] only if you need those logins

Keep the password out of the script by reading it from the environment:

#!/usr/bin/env python3
import os
import winrm

session = winrm.Session(
    "https://server.example.com:5986/wsman",
    auth=(os.environ["WIN_USER"], os.environ["WIN_PASS"]),
    transport="ntlm",
    server_cert_validation="validate",   # keep certificate checks on
    ca_trust_path="/etc/ssl/certs/ca-certificates.crt",
)

r = session.run_ps("Get-CimInstance Win32_OperatingSystem | Select-Object Caption, LastBootUpTime")
print(r.status_code, r.std_out.decode(), r.std_err.decode())

Run it with WIN_USER='SERVER\admin' WIN_PASS='…' python3 check.py, or better, load the variables from a secrets manager. run_ps runs PowerShell; run_cmd runs a plain command-line program.

4. Or use OpenSSH and PowerShell 7

OpenSSH Server is an optional feature on Windows Server 2019 and 2022; Windows Server 2025 includes it, but you still need to enable the service.

# On the Windows server, as Administrator
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Set-Service -Name sshd -StartupType Automatic
Start-Service sshd

The installer normally adds a firewall rule for port 22; limit it to your IP addresses as you did for WinRM. Then, from Linux, ssh [email protected] opens a shell. Use key authentication: for administrator accounts, Windows reads keys from C:\ProgramData\ssh\administrators_authorized_keys, not from the user's own folder.

For full PowerShell remoting over SSH, install PowerShell 7 on both machines, add this line to C:\ProgramData\ssh\sshd_config on the server, and restart sshd:

Subsystem powershell c:/progra~1/powershell/7/pwsh.exe -sshs -nologo

Then, from pwsh on Linux:

Enter-PSSession -HostName server.example.com -UserName admin
Invoke-Command -HostName server.example.com -UserName admin -ScriptBlock { Get-Service W3SVC }

5. Everyday tasks

These commands work through either route:

Get-Service W3SVC, WinRM | Select-Object Name, Status               # service status
Restart-Service W3SVC                                                # restart IIS
Get-Volume | Select-Object DriveLetter, SizeRemaining, Size         # disk space
Import-Module WebAdministration; Get-Website | Select-Object Name, State, PhysicalPath
Restart-WebAppPool -Name "MyAppPool"                                 # recycle one app pool
Get-WinEvent -LogName System -MaxEvents 20 | Where-Object LevelDisplayName -eq "Error"

Use Get-WinEvent, not the older Get-EventLog, which exists only in Windows PowerShell 5.1 and not in PowerShell 7.

6. Security checklist

7. Troubleshooting

8. Windows hosting at Domain India

If you only need to run ASP.NET sites, you don't have to manage a Windows server at all. Domain India's Windows hosting gives you IIS, MSSQL and email through the Plesk panel, with free SSL. You manage sites, databases and application pools in Plesk; there is no RDP or SSH. See the Plesk Windows hosting guide and IIS application pools. The price on the card is a Domain India list price, excluding 18% GST.

Frequently asked questions

Ready to host ASP.NET without running a server? Compare Windows hosting plans, or read the Plesk Windows hosting guide to see how sites are managed.