jscu-nl / logging-essentials Goto Github PK

Please be aware that in https://github.com/JSCU-NL/logging-essentials/blob/main/WindowsEventCollection.adoc#step-3-add-network-service-to-event-log-readers it says:

This option allows one to specify from which IP-addresses to accept WS-Management traffic. In our environment we only want to accept traffic from the local network which has the 10.0.10.0/24 subnet configured. Inside the IPv4 filter option we specify 10.0.10.1-10.0.10.254

This is a dangerous misconception. Setting the filter only limits the interface where WinRM will start a listener on (as it says in the description of the GPO)
Setting the filter to a value will stop all WinRM listeners not on a interface with an IP in this range.
It will also not limit the source IP of a client. You will have to use the Windows Firewall (or equivalent) to limit the source IP range.