winrm-rs

Async WinRM (WS-Management) client for Rust.

use winrm_rs::{WinrmClient, WinrmConfig, WinrmCredentials};

#[tokio::main]
async fn main() -> Result<(), winrm_rs::WinrmError> {
    let client = WinrmClient::new(
        WinrmConfig::default(),
        WinrmCredentials::new("administrator", "secret", ""),
    )?;

    let output = client
        .run_powershell("win-server", "Get-Service | ConvertTo-Json")
        .await?;
    println!("{}", String::from_utf8_lossy(&output.stdout));
    Ok(())
}

Features

• NTLMv2 authentication -- pure Rust, no OpenSSL or system SSPI required
• Basic authentication -- for test environments or HTTPS-secured endpoints
• Kerberos authentication -- via cross-krb5, feature-gated (--features kerberos)
• Certificate authentication -- TLS client certificate auth
• PowerShell execution -- scripts auto-encoded as UTF-16LE Base64 (-EncodedCommand)
• Raw command execution -- cmd.exe or any executable with arbitrary arguments
• Full shell lifecycle -- create, execute, receive, signal, delete
• Streaming output -- start_command + receive_next for incremental polling
• File transfer -- upload/download files via PowerShell base64 chunking
• Proxy support -- HTTP proxy for all WinRM requests
• Async/await -- built on tokio and reqwest
• TLS support -- rustls backend, optional invalid cert acceptance
• Cross-platform -- runs from Linux, macOS, or Windows

Installation

cargo add winrm-rs
# For Kerberos support:
cargo add winrm-rs --features kerberos

Usage

Basic authentication

use winrm_rs::{AuthMethod, WinrmClient, WinrmConfig, WinrmCredentials};

let client = WinrmClient::new(
    WinrmConfig {
        auth_method: AuthMethod::Basic,
        use_tls: true,
        port: 5986,
        ..WinrmConfig::default()
    },
    WinrmCredentials::new("admin", "password", ""),
)?;

NTLM authentication (default)

let client = WinrmClient::new(
    WinrmConfig::default(), // port 5985, NTLM, no TLS
    WinrmCredentials::new("admin", "password", "MYDOMAIN"),
)?;

Kerberos authentication

// Requires: cargo add winrm-rs --features kerberos
// Requires: kinit user@REALM has been run
let client = WinrmClient::new(
    WinrmConfig {
        auth_method: AuthMethod::Kerberos,
        ..WinrmConfig::default()
    },
    WinrmCredentials::new("user", "", ""),
)?;

Certificate authentication

let client = WinrmClient::new(
    WinrmConfig {
        auth_method: AuthMethod::Certificate,
        use_tls: true,
        port: 5986,
        client_cert_pem: Some("/path/to/cert.pem".into()),
        client_key_pem: Some("/path/to/key.pem".into()),
        ..WinrmConfig::default()
    },
    WinrmCredentials::new("admin", "", ""),
)?;

PowerShell execution

let output = client.run_powershell("win-server", "$PSVersionTable | ConvertTo-Json").await?;
assert_eq!(output.exit_code, 0);
println!("{}", String::from_utf8_lossy(&output.stdout));

Raw command execution

let output = client.run_command("win-server", "ipconfig", &["/all"]).await?;
println!("{}", String::from_utf8_lossy(&output.stdout));

Streaming output

let shell = client.open_shell("win-server").await?;
let cmd_id = shell.start_command("ping", &["-t", "10.0.0.1"]).await?;
loop {
    let chunk = shell.receive_next(&cmd_id).await?;
    print!("{}", String::from_utf8_lossy(&chunk.stdout));
    if chunk.done { break; }
}
shell.close().await?;

File transfer

use std::path::Path;

// Upload
let bytes = client.upload_file("win-server", Path::new("local.bin"), "C:\\remote\\file.bin").await?;

// Download
let bytes = client.download_file("win-server", "C:\\remote\\file.bin", Path::new("local.bin")).await?;

Configuration

WinrmConfig fields:

Roadmap

Comparison

Contributing

Contributions are welcome. Please open an issue to discuss larger changes before submitting a PR.

cargo test --workspace    # run tests
cargo clippy --workspace  # lint
cargo fmt --check         # format check

Integration tests

Most tests run against wiremock and need no external setup. The file tests/integration_real.rs targets a real Windows host and is ignored by default. To run it, set the following environment variables and use --ignored:

WINRM_TEST_HOST=192.0.2.10 \
WINRM_TEST_USER=Administrator \
WINRM_TEST_PASS='secret' \
cargo test --test integration_real -- --ignored

Cargo features

License

Licensed under either of Apache License, Version 2.0 or MIT License at your option.