Strata Copilot
    Next-Gen Trust Security
    : Create a Microsoft IIS machine
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security overview
    5. Welcome to installations
    6. About machines
    7. Create a new machine
    8. Create a Microsoft IIS machine

    Next-Gen Trust Security

    Create a Microsoft IIS machine

    Table of Contents

    Create a Microsoft IIS machine

    Creating a machine enables Next-Gen Trust Security to connect directly to Microsoft IIS so certificates can be installed and managed. After creating the machine, you can provision certificates to it.

    Before you begin

    Choose the most secure authentication method supported by your environment.
    The following methods are listed from most to least secure:
    • Kerberos authentication over HTTPS (recommended)
    • Kerberos authentication over HTTP
    • Basic authentication over HTTPS
    You will also need:
    • Windows Remote Management (WinRM) enabled on the target host
    • Credentials with permissions to create, read, and write to the IIS certificate stores
    • Supported Windows versions:
      • Windows Server 2019
      • Windows Server 2022
    Ensure that the required Windows Remote Management (WinRM) ports are open from the Next-Gen Trust Security VSatellite machine to the target Windows Server. Firewalls or network security controls that block these ports will prevent certificate operations, discovery, or provisioning.
    Required ports
    PurposeProtocolPortWhen required
    WinRM over HTTPTCP5985When the machine uses WinRM over HTTP (for example, Kerberos over HTTP).
    WinRM over HTTPSTCP5986When the machine uses WinRM over HTTPS (for example, Kerberos over HTTPS or Basic Authentication over HTTPS).
    Kerberos authenticationTCP and UDP88Required whenever Kerberos authentication is used. The Next-Gen Trust Security VSatellite must reach a domain controller’s Kerberos service.
    Important:
    • Confirm that TCP 5985 and/or TCP 5986 are reachable if you're using the default WinRM listener configuration.
    • When using Kerberos authentication, verify that TCP/UDP 88 is open between the VSatellite and your domain controller.
    • If your environment uses custom WinRM ports, ensure those ports are reachable.
    • Blocked ports frequently cause Test Access failures or authentication errors during machine creation or certificate provisioning.

    Configure the machine

    From Authentication Type, select the method you want to use, then follow the corresponding steps.
    Warning: Always use the most secure authentication method allowed by your environment. Less secure methods increase the risk of credential exposure.
    Note:
    • If a username in UPN format (for example, user@domain.com) fails, try using only the username (for example, user).
    • Windows Management Framework (WMF) 5.1 or later is required.

    Kerberos authentication over HTTPS

    Prerequisites

    • The IIS host must already have a valid TLS server certificate installed.
    • The certificate must be located in the LocalMachine\My certificate store.
    • The account used must have local administrative permissions.
    1. Enter the Microsoft IIS Hostname and WinRM Port.
    2. Enable Use TLS for WinRM.
    3. Enter the Domain Name, Key Distribution Center Address, and Service Principal Name.
    4. Select Enter Credentials or Select Credentials, then provide the required credentials.
    Warning: Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
    1. Click Test Access, then click Create.

    Kerberos authentication over HTTP

    Prerequisites

    • The IIS host must allow unencrypted WinRM traffic.
    • The account used must have local administrative permissions.
    1. Enter the Microsoft IIS Hostname and WinRM Port.
    2. Leave Use TLS for WinRM disabled.
    3. Enter the Domain Name, Key Distribution Center Address, and Service Principal Name.
    4. Select Enter Credentials or Select Credentials, then provide the required credentials.
    Warning: Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
    1. Click Test Access, then click Create.

    Basic authentication over HTTPS

    Prerequisites

    • The IIS host must have a valid TLS server certificate installed.
    • The account used must be a local administrator.
    1. Enter the Microsoft IIS Hostname and WinRM Port.
    2. Enable Use TLS for WinRM.
    Warning: Disabling TLS sends credentials in plaintext and is not recommended.
    1. Select Enter Credentials or Select Credentials, then provide the required credentials.
    Warning: Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
    1. Click Test Access, then click Continue.

    What's next?

    © 2026 Palo Alto Networks, Inc. All rights reserved.