RemoteMethod is a listener web application running on IIS that turns the messy world of Remote PowerShell sessions into clean, idempotent HTTPS endpoints. Your orchestration tools — vRO, Ansible, Terraform, Jenkins — call the same API. Active Directory and Windows obey.
stateful · brittle · privileged
stateless · idempotent · scoped
Every operation is a discrete, idempotent HTTPS endpoint. No sessions to nurse, no scripts to maintain, no double-hop voodoo. Speak JSON, get structured results.
POST /api/v1/ad/users
The IIS app pool runs as a scoped Windows identity. Your orchestrators never hold domain admin credentials. The least-privilege boundary lives where it should.
identity = scoped_acct
Every transaction is validated against a registered, signed contract before execution. Schema, scope, and intent must all match — or the request never touches AD.
contract.verify() → exec
Every accepted request is hashed and chained to an append-only log. Forensics-friendly. Compliance-friendly. Auditor-friendly. No "who ran this?" mysteries.
tail -f audit.log
vRO calls the same endpoint Ansible calls. Terraform calls the same endpoint Jenkins calls. One API, one set of behaviors, one source of truth across teams.
curl · pwsh · python · *
Ships as a standard IIS web application. Deploy with the same MSI/WebDeploy patterns your team already uses. No new agents on every Windows host.
msiexec /i remotemethod.msi
vRO triggers a workflow when a new VM lands. One POST /api/v1/computers joins the domain, drops it in the right OU, applies baseline GPO, sets local admin, and registers it in the CMDB. Three steps, one transaction, one audit row.
HRIS hands Ansible a new hire. Playbook calls POST /api/v1/users — RemoteMethod creates the AD account, attaches groups, enables M365 licensing, and provisions a home directory. New employee is productive before lunch.
Terraform owns infrastructure state. POST /api/v1/config applies registry keys, service configurations, firewall rules, and scheduled tasks. Drift reports come back to plan/apply natively.
Jenkins runs nightly offboarding. POST /api/v1/offboard disables the AD user, revokes groups, archives the mailbox, rotates shared keys, and moves the object to the disabled OU. Compliance evidence in one log entry.
# onboard a new user — same call from any orchestrator
curl -X POST https://rm.corp.local/api/v1/users \
-H "Content-Type: application/json" \
--cert ./client.pfx \
-d '{
"samAccountName": "j.doe",
"ou": "OU=NewHires,DC=corp,DC=local",
"groups": ["VPN_Users","Confluence"],
"contract": "user.onboard.v3"
}'
# → 201 Created
# → { "txId": "rm-9c4f...", "audit": "/audit/9c4f", "status": "ok" }Drop-in REST host action. Map workflow inputs straight to RemoteMethod contracts. No PowerShell host required.
vRO → REST → /api/v1/*
Use ansible.builtin.uri against RemoteMethod from your Linux control node. No Windows nodes, no WinRM, no kerberos config.
uri: url=/api/v1/users
Use the http provider or wrap RemoteMethod in a custom provider. Plan/apply against AD and Windows like any other resource.
resource "rm_user" "x"
Pipeline step or HTTP request plugin. Make Windows operations a normal stage in your CI/CD — no agents, no slaves.
httpRequest url:'/api/v1/*'
Outbound REST messages from catalog items or flows. Turn SNOW requests into validated, audited Windows changes.
RESTMessageV2 → /api/v1
It's HTTPS + JSON. Anything that speaks REST can drive RemoteMethod. SDKs available for PowerShell, Python, and Go.
requests.post(...)
Modern ciphers only. Client certificate pinning supported for orchestrator-to-listener trust.
Caller is identified by their Windows account or service principal. No shared API keys floating in pipeline secrets.
The IIS app pool runs as a dedicated, least-privilege identity. Domain admin credentials never touch your orchestrators.
Every transaction must match a registered, signed contract. Schema, scope, and intent are validated before any privileged call.
Every accepted request is hashed and chained. Tamper-evident, exportable, and compatible with SIEM ingestion.
Per-caller scopes and per-contract throttles. Stop a runaway pipeline before it stops you.
single environment · pilot
production · multi-team
global · regulated
// all tiers include perpetual right-to-use of installed binaries · annual prepay available · gov / multi-tenant pricing on request
Architecture reviews, technical demos, proof-of-concept deployments. Tell us your stack and we'll show you a working integration in under 30 minutes.