How to run a PowerShell script on multiple remote computers
You have a script that works on your own PC. Now it has to run on 20 others. Here are the four common ways to do it, what each one needs, and where each one stops working.
Short answer: inside one office network with a domain, Invoke-Command (PowerShell Remoting) is built in and free. Once PCs sit in different networks, at home or behind NAT, an agent that connects out to a cloud panel is the option that keeps working without a VPN or open ports.
1. PowerShell Remoting (WinRM) with Invoke-Command
PowerShell Remoting is part of Windows. You enable it on every target PC once, then run a script block on many machines in parallel from your own PC:
# Once, on each target PC, in an elevated PowerShell
Enable-PSRemoting -Force
# From your admin PC
Invoke-Command -ComputerName PC-01, PC-02, PC-03 -ScriptBlock {
Get-Service Spooler | Select-Object Status, Name
}
To run a script file instead of a block, use -FilePath C:\Scripts\cleanup.ps1. Results come back as objects, each tagged with PSComputerName.
What it needs
- The WinRM service running on every target, and the firewall allowing TCP 5985 (HTTP) or 5986 (HTTPS).
- Network reach from your PC to theirs — same LAN or a VPN.
- In an Active Directory domain, Kerberos handles authentication. In a workgroup you must add the PCs to
TrustedHostson your machine and pass credentials with-Credential. Enable-PSRemotingrefuses to configure the firewall while a network adapter is set to the Public profile, which is common on laptops.
Where it breaks: laptops at home, branch offices without a VPN, PCs that are not in the domain.
2. PsExec
PsExec from Microsoft Sysinternals starts a process on a remote PC over SMB:
psexec \\PC-01 -s powershell -NoProfile -Command "Get-Volume"
- Needs SMB (TCP 445) and the
ADMIN$share reachable, plus an administrator account on the target. - Handy for one-off jobs in a LAN, but many antivirus and EDR products flag or block it, because attackers use the same technique.
- It runs one PC per command; looping over a list is up to you.
3. Remote desktop, one PC at a time
Connect with RDP, TeamViewer, AnyDesk or similar, open PowerShell, paste the script. It works for one machine. For 20 machines it is an afternoon, it interrupts the user, and nothing records what ran where.
4. An agent on every PC (RMM)
A small service on each PC keeps an outbound connection to a central panel. Because the PC connects out, there are no inbound ports to open and no VPN to maintain; it works the same in the office, at home or on hotel Wi-Fi. This is how RMM (remote monitoring and management) tools work, including CtrlSoft.
Running a script with CtrlSoft
- Install the agent on each PC — by hand, or silently on many PCs with one command.
- Open Scripts, save your PowerShell or CMD script once.
- Run it on a device now, or create a schedule for one device or the whole group.
- Read the output and exit code of every run in the script's history. For a quick one-off command, use the command console on the device page.
$env:ProgramData or HKLM: rather than $env:USERPROFILE or HKCU:.Comparison
| Method | Needs | Outside the office network | Many PCs at once |
|---|---|---|---|
| Invoke-Command | WinRM, ports 5985/5986, domain or TrustedHosts | Only with a VPN | Yes |
| PsExec | SMB 445, ADMIN$ share, admin account | Only with a VPN | With your own loop |
| Remote desktop | A remote-desktop tool and the user's time | Depends on the tool | No |
| Agent / RMM | Agent installed once, outbound HTTPS | Yes | Yes, with output history |
Tips that save you a rollback
- Run the script on one test PC first, then on the rest.
- Make scripts safe to run twice: check before you change (
if (-not (Test-Path ...))). - Return a clear exit code —
exit 1on failure — so the run shows as failed instead of silently succeeding. - Keep long-running jobs short or split them; remote sessions and agents usually have a timeout.
Try it on your own PCs
Free for 30 days on up to 5 devices. No card, no server, no VPN.
Start 30-day free trial