PowerShell / Windows - Security best practices for enabling Windows Remote Management

Question

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute commands on a remote server.

What are some security best practices to follow to limit the attack surface should an attacker compromise an internal system?

Is there anything that can be done to harden domain servers which have WinRM enabled?

Thinking in theory here, one idea that comes to mind is only allowing WinRM for a specific service account which has two-factor authentication. A normal domain account password and a rolling security token would lower the chances of this account being hijacked in the event of being compromised.

Answer 1

For my PowerShell remoting server, I utilize Just Enough Administration please see:

https://www.google.com/#q=Just+Enough+ADministration&*

Unique Runspaces:

This allows the user to execute scripts in their own runspace after you proxy the commands. Additionally, you can log significantly better, and it's based on the SID of the user who is invoking those commands.

Restricted Access:

You can restrict access to specific scripts from certain individuals or groups. You can also utilize CAS, Code Access Security, granted you are using any C#.

https://msdn.microsoft.com/en-us/library/930b76w0(v=vs.90).aspx

This way you can avoid using credssp and any double-hop authentication issues. Credssp will allow for MITM attacks, otherwise you'd have to create a single unique user and set your powershell configuration file to runas that user. The second suggestion is horrible for auditing.

Utilizing JEA would allow you to constrain users, audit those users and only allow them to execute specific commands.