WinRM

WinRM runs commands on Windows hosts over WS-Management. Both cmd and PowerShell, from macOS or Linux, with no PowerShell installed locally and no SSH subsystem on the target.

That combination is the point. Managing Windows boxes from a Mac has historically meant installing PowerShell Core, or standing up OpenSSH on every server, or giving up and opening RDP for a task that needs one command.

Auth and ports

NTLM over HTTP 5985 or HTTPS 5986. Credentials come from the vault like every other connection type.

Three ways in

As a saved connection. Pick WinRM as the connection type. It lives in your folder tree next to SSH and RDP, with the same search, tags, and audit trail.

From Quick Connect. Ad-hoc host plus inline credentials, for the box you’ll touch once.

As a companion to RDP. Any RDP session offers Run commands, which opens a WinRM session against the same host reusing the same stored credentials. You’re already in the GUI, you need one Get-Service — you don’t have to hunt for a PowerShell window inside the remote desktop.

That third path is where most people end up using it.

Shell selection

Each session targets cmd or PowerShell. PowerShell runs remotely on the target’s own PowerShell, so the version that matters is the server’s, not your workstation’s.

Requirements on the target

WinRM must be enabled and listening. On a domain-joined server that is usually already true via Group Policy. Otherwise, on the target:

winrm quickconfig

You also need a firewall rule for the listener port and an account with remote-management rights. ShellYard surfaces the WS-Management fault text when a connect fails, which distinguishes “not listening” from “listening but refusing this account” without a packet capture.

What it isn’t

Not an interactive terminal in the SSH sense. WS-Management is request/response — you send a command, you get its output. Long-running interactive programs, full-screen TUIs, and anything expecting a live PTY belong on RDP or an SSH session.

Not a domain-management tool either. For directory work — users, groups, unlocking accounts, resetting passwords — use the Active Directory browser.