WinRM

WinRM (Windows Remote Management) is the standard way to run commands and scripts on a Windows machine remotely - the engine behind PowerShell remoting. It uses a protocol called WS-Man carried over HTTPS. The Bridge brokers WinRM so that remote command execution on Windows is policy-controlled and recorded, and users never hold the target’s credentials.

Native clients connect through Bridge. There is no browser client for these protocols.

Granting access. Settings here enable WinRM for the deployment. To grant a person access to a host, create a checkout - see command filtering and the recording redaction override.

Native mode

Pick a port for the Bridge to listen on. Port 5986 is the conventional port for WinRM over HTTPS.

bridge.yaml

winrm:
  native:
    enabled: true
    listen: "5986"

Shared options

bridge.yaml

winrm:
  idle_timeout: 30m

Response-body redaction applies to WinRM. Because commands run through the Bridge, the Bridge can see and record their output. It can mask secrets in the recorded stdout and stderr (the standard output and error streams of the commands). This is governed by the recording setting server.recording.redact_response_bodies (on by default) and can be overridden per checkout.

Bridge retains full raw request and response bodies for authorized administrator review, subject to the 1 GiB per-body limit and recording-space reserve. Derived summaries can be truncated or partially decoded. Required recording failures end the affected operation.

Example

bridge.yaml

winrm:
  idle_timeout: 30m
  native:
    enabled: true
    listen: "5986"

Option reference

Option	Type	Default	Description
`winrm.idle_timeout`	duration	`30m`	Close a session after this much inactivity.
`winrm.native.enabled`	bool	`false`	Turn on native WinRM (a listening port).
`winrm.native.listen`	string (port)	`5986`	Port the Bridge listens on. Required when native is enabled.

Last updated on November 2, 2026

VNC beta