Author Posts

April 26, 2016 at 8:13 am


What uniquely identifiable information available which can be logged from within WinRM session? I need to be able to find out for example log IP address of client which connected to endpoint. I see how I can get username of connected user but is there any other information hidden somewhere in variables (like IP address or hostname of client etc)?

April 27, 2016 at 5:31 am

any information you collect locally can be done in the winrm session.
wmi is a good place to get the info you are after

$ip=get-WmiObject Win32_NetworkAdapterConfiguration|Where {$_.Ipaddress.length -gt 1} 

$pcinfo = get-WmiObject win32_computersystem

April 27, 2016 at 6:29 am

I mean I need to know client IP not target IP.
Client Computer1 connects to WinRM session on Server1. I want within WinRM session on Server1 to find out IP address of Computer1.

April 27, 2016 at 6:57 am

Ahh, off the top of my head I am not sure if that available via a built in command. If you have powershell logging enabled you may find the info in the event logs.