TransWikia.com

What could cause PowerShell Remoting to use high bandwidth?

Server Fault Asked by InterLinked on November 4, 2021

I do IT work for an organization that is currently setting up (or letting me set up) an Active Directory domain. Right now, it’s still in testing with 1 DC and 1 client. A week or two ago, our switch alerted us to excessive traffic between the domain controller and the domain-joined machine. It reported it as "Windows file sharing", which seemed a bit much. The data was on the order of 30 to 40 GB per week, which didn’t make any sense since these were test machines and idle most of the time.

We confirmed today the traffic was all on port 445. I ran Wireshark on the domain-joined computer and immediately noticed that a specific Group Policy path was appearing in ~90% of the packets. The policy had the same GUID, and I used GPMC to trace the GUID to a Allow PowerShell Remoting GPO I had set up a couple weeks previously to, well, allow PowerShell remoting.

All this GPO does is what it sounds like – open the necessary ports on each machine for remoting and allowing incoming connections as described in the documentation so that PS remoting works. I disabled the GPO just now, but just in the past couple hours it resulted in ~4 GB of traffic between the DC and the client. Could this be "normal" for any reason? Why would PS-Remoting be using this much bandwidth, and how might it be fixed?

Here is an HTML report of the GPO generated in PowerShell – formatting below is not great but it’s too large to screenshot:

Computer Configuration (Enabled)
Policies
Windows Settings
Scripts
Startup
For this GPO, Script order: Not configured
Name    Parameters
netsh.bat   
Security Settings
System Services
Windows Remote Management (WS-Management) (Startup Mode: Automatic)
Permissions
No permissions specified
Auditing
No auditing specified
Windows Firewall with Advanced Security
Global Settings
Policy  Setting
Policy version  2.10
Disable stateful FTP    Not Configured
Disable stateful PPTP   Not Configured
IPsec exempt    Not Configured
IPsec through NAT   Not Configured
Preshared key encoding  Not Configured
SA idle time    Not Configured
Strong CRL check    Not Configured
Inbound Rules
Name    Description
Windows Remote Management - Compatibility Mode (HTTP-In)    Compatibility mode inbound rule for Windows Remote Management via WS-Management. [TCP 80]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module  
Enabled True
Program System
Action  Allow
Security    Require authentication
Authorized computers    
Authorized users    
Protocol    6
Local port  80
Remote port Any
ICMP settings   Any
Local scope Any
Remote scope    Any
Profile All
Network interface type  All
Service All programs and services
Allow edge traversal    False
Group   Windows Remote Management
Windows Remote Management (HTTP-In) Inbound rule for Windows Remote Management via WS-Management. [TCP 5985]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module  
Enabled True
Program System
Action  Allow
Security    Require authentication
Authorized computers    
Authorized users    
Protocol    6
Local port  5985
Remote port Any
ICMP settings   Any
Local scope Any
Remote scope    Any
Profile All
Network interface type  All
Service All programs and services
Allow edge traversal    False
Group   Windows Remote Management
Connection Security Settings
Administrative Templates
Policy definitions (ADMX files) retrieved from the local machine.
Windows Components/Windows Remote Management (WinRM)/WinRM Service
Policy  Setting Comment
Allow remote server management through WinRM    Enabled 
IPv4 filter:    *
IPv6 filter:    
Syntax:
Type "*" to allow messages from any IP address, or leave the
field empty to listen on no IP address. You can specify one
or more ranges of IP addresses.
Example IPv4 filters:
2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22
*
Example IPv6 filters:
3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562
*
User Configuration (Enabled)
No settings defined.

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP