winrm - enable-psremoting error

Question

_{Sunday, December 29, 2013 6:15 PM}

Hello,

Why am i receiving this error and how do I fix it?

PS C:\WINDOWS\system32> enable-psremoting -force

WinRM is already set up to receive requests on this computer.
Set-WSManQuickConfig : <f:WSManFault xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault" Code="5"
Machine="HOSTNAME1"><f:Message>The WinRM client cannot process the request. The WinRM client tried
to use Negotiate authentication mechanism, but the destination computer (localhost:47001) returned an 'access denied'
error. Change the configuration to allow Negotiate authentication mechanism to be used or specify one of the
authentication mechanisms supported by the server. To use Kerberos, specify the local computer name as the remote
destination. Also verify that the client computer and the destination computer are joined to a domain. To use Basic,
specify the local computer name as the remote destination, specify Basic authentication and provide user name and
password. Possible authentication mechanisms reported by server:       Kerberos   </f:Message></f:WSManFault>
At line:69 char:17
+                 Set-WSManQuickConfig -force
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Set-WSManQuickConfig], InvalidOperationException
    + FullyQualifiedErrorId : WsManError,Microsoft.WSMan.Management.SetWSManQuickConfigCommand

thank you.

All replies (7)

_{Monday, January 6, 2014 2:27 AM ✅Answered | 2 votes}

Hi IUSR345369,

You can try to save winrm set winrm/config/service/auth '@{Kerberos="true"}'  as .ps1 file, and deploy the logon script in Group Policy.

For the detailed information to deploy powershell script as logon script in Group Policy, please refer to this article:

Using Group Policy to Deploy a Windows PowerShell Logon Script:

http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/14/weekend-scripter-using-group-policy-to-deploy-a-windows-powershell-logon-script.aspx

I hope this helps.

We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

_{Monday, January 6, 2014 3:06 AM ✅Answered | 3 votes}

Hello,

Yes, you can configure the WinRM authentication types using Active Directory Group Policy Objects (GPO). Keep in mind that there are separate settings for the WinRM Client and WinRM Service.

The settings are located under Computer Configuration --> Administrative Templates --> Windows Components --> Windows Remote Management (WinRM) --> WinRM Client | WinRM Service.

Here is a screenshot of the Group Policy settings for the WinRM Service.

If this post was helpful, please click the little "Vote as Helpful" button :)

Trevor Sullivan
Trevor Sullivan's Tech Room
Twitter Profile

_{Monday, December 30, 2013 5:31 AM}

Hi IUSR345369,

To solve the error, please try to enable Negotiate Authentication in the local host, run "gpedit.msc" -> Computer Configuration -> Administrative Templates -> Windows Components > Windows Remote Management > WinRM Service:
Disallow Negotiate Authentication: Disabled.

I hope this helps.

We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

_{Monday, December 30, 2013 10:41 AM}

Hello,

Thanks for that tip. But what if I cannot enable Negotiate and want to make it work only with Kerberos. What should I change to make that work? 

thanks

_{Sunday, January 5, 2014 2:19 PM}

Hi IUSR345369,

Sorry for the delayed reponse.

You can try the steps below:

1.Enter the following command:
winrm quickconfig

2.Enter the following command to check the authentication status:
winrm get winrm/config/service
And confirm whether the kerberos is "flase".

3.Enter the following command to enable Kerberos authentication:
winrm set winrm/config/service/auth '@{Kerberos="true"}'

I hope this helps.

We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

_{Sunday, January 5, 2014 8:27 PM}

Thank you.

is this configurable by Group Policy? If so can you tell me which setting controls that?

thank you

_{Thursday, January 9, 2014 1:27 PM}

Thank you Anna, and Thank you Trevor!