undo-winrmconfig-during-shutdown

Disable winrm through a self-deleting shutdown task.

Many windows remote orchestration tools (e.g. Packer) instruct you to completely open up winrm permissions in a way that is not safe for production.

Usually there is no built in method nor instruction on how to re-secure it or shut it back down.

The assumption most likely being that you would handle proper winrm re-configuration as a part of production deployment.

This is not a least privileged approach - depending on how big your company is and how widely your hypervisor templates are used - this is a disaster waiting to happen. So I feel leaving it in a disabled state by default is the far safer option.

To complicate things, if you attempt to secure winrm or shut it down as your last step in orchestration you slam the door on the orchestration system and it marks the attempt as a failure.

Due to imprecise timing, start up tasks that disable winrm could conflict with a subsequent attempt to re-enable it on the next boot for final configuration steps (especially if you are building a hypervisor template).

This self-deleting shutdown task performs the disable on the first shutdown and deletes itself.

If a system shutsdown extremely quickly there is some risk that the shutdown job would not be deleted - but in testing on AWS (very fast shutdown), there have not been an observed problems.