WinRM Security Help

Question

Hi, I've been trying to figure out the WinRM event history on my computer, and more specifically, if someone might have potentially used WinRM to gain unauthorized remote access to my machine. I am attaching a pdf with 277089-winrm-logs-compressed.pdf here, could someone please help me review them and let me know if any of those events indicate any signs of remote access / intrusion. I use Windows 11, and I never set up WinRM to begin with. Thank you so much in advance.

Answer 1

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query.

To check the event history,. all you need to do is to:

1. Toggle to the Tools tab.
2. Click Remote Control in the Windows Tools section to start.
3. To view a computer's history of remote controls, click View History next to the computer's name.

Follow the instructions below to view the history of every computer:

1. Toggle to the Admin tab.
2. In the Tools section, click Action Log Viewer
3. Select the Remote Control checkbox under the Select Module Type section.
4. Click show.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.