Windows Server¶

ConfigWinRM.ps1¶

Synopsis: Enables, configures and secures the WinRM service on a Windows server for Zabbix/Ansible remoting.

Reads WinRM/firewall/authentication settings from an external XML configuration file (ConfigWinRM.xml, located next to this script) and brings the local WinRM service, its HTTP/HTTPS listeners, authentication methods, LocalAccountTokenFilterPolicy registry key, and related Windows Firewall rules in line with that configuration. Must be run elevated (Administrator). Progress and errors are written to the console and to a daily log file under C:\WinRM\Logs.

Parameters:

Parameter	Description
`None`	This script takes no command-line parameters; all settings are read from C:\WinRM\ConfigWinRM.xml.

Examples:

PS> .\ConfigWinRM.ps1
Runs an elevated PowerShell session, reads C:\WinRM\ConfigWinRM.xml and applies the
configured WinRM/firewall settings, logging the result to C:\WinRM\Logs.

Notes

Author: Martin Hudak Created: 2022-11-16 Version: 1.02 Changelog: 1.00 - Initial version, based on the community WinRM-over-HTTPS bootstrap script (Trond Hindenes, Chris Church, Michael Crilly, Anton Ouzounov, Nicolas Simond, Dag Wieers, Jordan Borean, Erwan Quelin, David Norman - see .RELEASENOTES above for full attribution) 1.01 - Fixed issue with HTTPS when certificate in HTTPS listener doesn't match the cert in local store 1.02 - Fixed issue when script fails on removing listeners if only HTTP listener exists (no HTTPS listener exists)

Download-WinRMConfigScript.ps1¶

View in Gitea

Synopsis: Downloads ConfigWinRM.ps1 and ConfigWinRM.xml to C:\WinRM and optionally sets the Zabbix Proxy IP address as the WinRM firewall trusted host.

Downloads ConfigWinRM.ps1 and ConfigWinRM.xml from the internal Git server (git.totalservice.cz, WindowsServer repo) into C:\WinRM, creating that folder if it does not already exist. After the download, it asks for the Zabbix Proxy IP address: if one is entered, it is written into the element of the downloaded ConfigWinRM.xml; if the prompt is left empty (Enter only), ConfigWinRM.xml is left unchanged. The IP address can also be supplied directly via the -ZabbixProxyIPAddress parameter to run the script non-interactively.

Parameters:

Parameter	Description
`ZabbixProxyIPAddress`	Zabbix Proxy IP address to allow through the WinRM firewall rule (FWWinRMTrustedHosts in ConfigWinRM.xml). Omit this parameter to be prompted interactively (or to fall back to $env:ZabbixProxyIPAddress if that is set); pass an empty string to skip the prompt and leave the existing value in ConfigWinRM.xml unchanged.

Examples:

PS> .\Download-WinRMConfigScript.ps1
Downloads both files to C:\WinRM and interactively prompts for the Zabbix Proxy IP
address.

PS> .\Download-WinRMConfigScript.ps1 -ZabbixProxyIPAddress '192.168.10.50'
Downloads both files and sets FWWinRMTrustedHosts to 192.168.10.50 without prompting.

PS> irm https://s.tslab.cz/ZBXWinRM | iex
Shortest way to run the script directly from the repo without saving it locally
first; prompts interactively for the Zabbix Proxy IP address.

Notes

This file is intentionally plain ASCII, no BOM. A UTF-8 BOM broke the primary "irm | iex" use case: the BOM bytes were not decoded correctly across the download pipeline, which made the parser fail to recognize the opening "<#" of this comment block and try to run the whole header as code.

Author: Petr Stepan Created: 2026-07-21 Version: 1.2.3 Changelog: 1.0.0 - Initial version 1.1.0 - Added $env:ZabbixProxyIPAddress fallback so a plain "irm | iex" one-liner can supply the IP address without "& { ... } -Param" wrapping 1.2.0 - Only call exit when running as a real .ps1 file, not when run via "irm | iex" - exit would otherwise close the caller's PowerShell window 1.2.1 - Fixed "'Path' cannot be found" under Set-StrictMode when run via iex - use $PSCommandPath instead of $MyInvocation.MyCommand.Path 1.2.2 - Fixed the same class of error in Update-WinRMTrustedHostConfig: use SelectSingleNode instead of dot-property access so a missing element is detected cleanly instead of throwing a raw StrictMode error 1.2.3 - Removed UTF-8 BOM and non-ASCII characters (broke "irm | iex" - see note above)

Install-ZBXAgentManual.ps1¶

View in Gitea

Synopsis: Downloads and silently installs Zabbix Agent 2 for Windows, configured for a Zabbix Proxy/Server, and opens the firewall for passive checks.

Downloads the Zabbix Agent 2 Windows MSI from cdn.zabbix.com and installs it silently via msiexec. Hostname is set to the local computer name; both Server and ServerActive are set to the Zabbix Proxy/Server IP address supplied by the caller (interactively, via -ZabbixProxyIPAddress, or via $env:ZabbixProxyIPAddress). After a successful install it creates a Windows Firewall rule allowing inbound TCP 10050 (Zabbix Agent passive checks) from that same IP address only. Must be run elevated (Administrator).

Parameters:

Parameter	Description
`ZabbixProxyIPAddress`	IP address of the Zabbix Proxy or Zabbix Server. Used for both the agent's Server and ServerActive settings, and as the only allowed remote address for the TCP 10050 firewall rule. Omit this parameter to be prompted interactively (or to fall back to $env:ZabbixProxyIPAddress if that is set).
`ZabbixAgentMsiUri`	URI of the Zabbix Agent 2 Windows MSI to download and install. Defaults to version 7.2.13. Override this to install a different version/build, e.g. one of the other files listed under https://cdn.zabbix.com/zabbix/binaries/stable///.

Examples:

PS> .\Install-ZBXAgentManual.ps1
Downloads and installs Zabbix Agent 2, prompting for the Zabbix Proxy/Server IP
address.

PS> .\Install-ZBXAgentManual.ps1 -ZabbixProxyIPAddress '192.168.10.50'
Downloads and installs Zabbix Agent 2 non-interactively.

PS> .\Install-ZBXAgentManual.ps1 -ZabbixProxyIPAddress '192.168.10.50' -ZabbixAgentMsiUri 'https://cdn.zabbix.com/zabbix/binaries/stable/7.0/7.0.14/zabbix_agent2-7.0.14-windows-amd64-openssl.msi'
Installs a different Zabbix Agent 2 version instead of the default 7.2.13.

PS> irm https://s.tslab.cz/ZBXAgent | iex
Shortest way to run this directly from the repo without saving it locally first;
prompts interactively for the Zabbix Proxy/Server IP address and installs the
default MSI version.

Notes

Author: Petr Stepan Created: 2026-07-21 Version: 1.1.0 Changelog: 1.0.0 - Initial version 1.1.0 - Made ZabbixAgentMsiUri a parameter (was hardcoded) so a different agent version can be installed without editing the script

Resize-OSPartition.ps1¶

View in Gitea

Synopsis: Safely (re)creates the Recovery Partition (WinRE) at the end of the system disk and, on request, expands C: into the remaining space.

Multi-phase, highly defensive script: PHASE 1 - DISCOVERY (read-only) PHASE 2 - VALIDATION (read-only) PHASE 3 - USER CONFIRMATION PHASE 4 - DESTRUCTIVE OPERATION (remove old Recovery, if present) PHASE 5 - REBUILD (create new Recovery FIRST at the TRUE end of the disk using an explicit -Offset, then optionally expand C: into whatever remains, THEN enable WinRE) PHASE 6 - VALIDATION (final audit) PHASE 7 - FINAL REPORT

v2.1.0 CHANGES (bugfix release): - New-RecoveryPartition now computes an EXPLICIT end-of-disk -Offset (disk.Size - buffer - RecoverySizeMB) instead of letting New-Partition auto-place it. Auto-placement (no -Offset) puts a new partition at the START of the first available free extent - NOT the end. Since the free extent runs from the end of C: to the end of the disk, this glued Recovery directly onto C: and pushed ALL remaining free space past Recovery, to the true end of the disk - the opposite of the intended design, and it also meant the gap-to-expand-C-into was always computed as ~0 MB, so the script never asked to expand C:. - The interactive "expand C: into remaining space?" question is now asked BEFORE reagentc /enable, not after. Recovery is created at the true end of the disk (so there can be a gap between C: and Recovery at that point); if adjacency between C: and Recovery really is required for reagentc to accept the partition (per this script's own prior testing notes), closing that gap has to happen before WinRE is enabled, not after. - The old "blocking partition directly after C:" hard-abort guard (which assumed Recovery must always sit immediately after C:) was relaxed to an informational check, since Recovery is no longer required to be placed immediately after C: at creation time.

An existing Recovery Partition is OPTIONAL on input. If none is found, the script treats this as a fresh-build scenario (e.g. after a manual diskpart shrink) instead of failing.

The script NEVER assumes Disk 0, Partition 4, or any fixed size. Every disk/partition reference is re-detected dynamically and re-validated immediately before any destructive action.

Parameters:

Parameter	Description
`AuditOnly`	Performs full discovery + validation, prints the plan, but makes NO changes to the system.
`RecoverySizeMB`	Target size (MB) of the new Recovery Partition. Default 2000. NOTE: 1024 MB is NOT reliably enough on modern Windows 11 - reagentc /enable silently falls back to storing WinRE inside C: itself (instead of using the Recovery partition) if the partition is too small for the current Winre.wim plus its own required working-space buffer, even though the partition otherwise looks perfectly valid. The script also checks the actual current Winre.wim size at runtime and warns if this value is too small for it.
`DiskEndBufferMB`	Small safety buffer (MB) left truly unallocated at the very end of the disk, to avoid colliding with the GPT backup header / alignment rounding. Default 1.
`LogPath`	Directory for the log file. Default C:\Temp.
`SkipBanner`	Suppresses the ASCII banner.

Examples:

.\WinRE-Resize2.ps1 -AuditOnly

.\WinRE-Resize2.ps1 -RecoverySizeMB 1024

Notes

Author : F.Š. | Windows Recovery Partition Tool Version: 2.1.0