WinRM client could not create a push subscription

Question

I have a Windows Event Collector that was running fine. I had set all the wsman permissions and was using source-initiated subscriptions.

We began using a micro-segmentation platform that manages the Windows Firewall. It determined (correctly) that traffic was occurring on port 5985 (HTTP), but when the rules were enabled, the subscriptions stopped working.

If I try to retry the suscription, I receive a message that states:

"The WinRM client could not create a push subscription because there are no listeners configured that match the specified hostname and transport, or because there is no enabled firewall exception on the port used by the selected listener.

Change the hostname and transport, create an appropriate firewall exception, or run winrm quickconfig"

Keep in mind, port 5985 IS open on the Win Firewall and this was working before.

It seems that even though port 5985 is open, that when retrying the subscription, it's not actually checking to see if it can communicate on the specified port, it's just looking to see if certain things are enabled in the FW, even though it doesn't need them. As a test, we did enable port 5986 (HTTPS) even though we don't need it as the traffic is over 5985 and no traffic flows inbound to the WEC over 5986, but the message still states it needs some unknown FW exception. Yes, ran winrm quickconfig which says it enables the exception, but it gets overwritten right away, I'm assuming. I thought about logging what happens when I run that but not certain the best tool to use.

At the end of the day, I want to understand what needs to be enabled on the FW (even though it may not be used) for the WEC to see everything as okay.

Answer 1

Hello,

You can utilize a network analysis tool such as Wireshark or Network Monitor to determine if it's a network issue. If traffic is received on the terminal side, it likely indicates a service issue at the application level. However, if no traffic is received, it points to a network issue. Additionally, consider the possibility of middleware existing between the two devices.

---

If the Answer is helpful, please click "Accept Answer" and upvote it.