Windows Server 2025 WinRM Remoting Fails with “Access Denied” Between Systems Patched with KB5073379 / KB5077793

This behavior matches standard WinRM/PowerShell remoting restrictions for local accounts rather than a documented Windows Server 2025–specific change.

Key points from the available guidance:

1. Local administrator must have permission on the remoting endpoint
   By default, only members of the local Administrators group can use the default PowerShell remoting endpoints. If "Access is denied" is returned, verify that the local Administrator account actually has execute permission on the Microsoft.PowerShell (and Microsoft.PowerShell32, if applicable) session configurations:

      # On SERVER-B (target)
      Set-PSSessionConfiguration Microsoft.PowerShell -ShowSecurityDescriptorUI
   

   Ensure the local Administrators group (and/or the specific local Administrator account) has Execute permission.
2. LocalAccountTokenFilterPolicy and UAC remote restrictions
   For local accounts, UAC remote restrictions can cause remote connections to run with a filtered (non‑admin) token, which results in "Access is denied" even when the credentials are correct. The documented way to disable this behavior is the LocalAccountTokenFilterPolicy registry value:

      $newItemPropertySplat = @{
        Name = 'LocalAccountTokenFilterPolicy'
        Path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
        PropertyType = 'DWord'
        Value = 1
      }
      New-ItemProperty @newItemPropertySplat
   

   This setting disables UAC remote restrictions for all users on the affected computer, so it is a security trade‑off and should be evaluated carefully. After setting it, restart the target or at least the WinRM service.
3. Using explicit credentials for local admin
   When connecting, always supply explicit credentials for the local Administrator account and ensure they are used by the remoting cmdlets:

      $cred = Get-Credential  # enter SERVER-B\Administrator and the local password
      Enter-PSSession -ComputerName SERVER-B -Credential $cred
   

   The remoting documentation explicitly notes that alternate credentials must be supplied when needed and that the account must be in Administrators on the target.
4. TrustedHosts and non‑domain scenarios
   In non‑domain or non‑Kerberos scenarios (such as using local accounts, IP addresses, or workgroup‑like conditions), WinRM requires either HTTPS or that the target be added to TrustedHosts, and that credentials be supplied. The documented behavior is:
   • Add the target to TrustedHosts on the client (SERVER-A).
   • Use the -Credential parameter for Enter-PSSession, New-PSSession, or Invoke-Command.
5. IP address vs. hostname
   If an IP address is used instead of a hostname, Kerberos cannot be used and NTLM is used instead. In that case, the requirements are:
   • IP must be in TrustedHosts.
   • Credentials must be supplied on every remote command.
6. No documented Windows Server 2025‑specific WinRM local admin change in the provided material
   The provided documentation describes:
   • WinRM treating Entra‑only or workgroup‑like machines specially (TrustedHosts, SPN prefix changes).
   • UAC remote restrictions and LocalAccountTokenFilterPolicy for administrators in other domains or local accounts.
   • SPN‑related WinRM failures and how to adjust SPNs or SPN prefixes. None of these explicitly call out a new Windows Server 2025‑only restriction on local administrator WinRM access. The behavior described aligns with existing, documented UAC and WinRM constraints.

Based on the available documentation, the expected and supported configuration for using a local Administrator account over WinRM is:

1. On the target (SERVER-B):
   • Ensure the account is in the local Administrators group.
   • Optionally set LocalAccountTokenFilterPolicy = 1 if full admin token is required remotely, understanding the security implications.
   • Confirm the Microsoft.PowerShell session configuration allows Administrators execute access.
2. On the source (SERVER-A):
   • Add SERVER-B (or its FQDN/IP) to TrustedHosts.
   • Use Enter-PSSession/New-PSSession/Invoke-Command with -Credential SERVER-B\Administrator.

If these conditions are met and "Access is denied" persists, this would be beyond what is covered in the referenced documentation and would warrant further investigation with support, but the documents provided do not describe a Windows Server 2025‑specific product issue.

References:

• about_Remote_Troubleshooting
• Deploy Storage Spaces Direct on Windows Server
• Troubleshoot Windows Admin Center
• Can't establish a PowerShell remote session using WinRM between Microsoft Entra-only joined machines
• Error 0x80090322 when you connect PowerShell to a remote server via WinRM
• Windows Admin Center known issues