WSManSafeClientList Registry Key

Question

What is WSManSafeClientList used for ?

what is this registry key meant and what does this value represent and how could we read the reg binary value currently set?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\SafeClientList - WSManSafeClientList

How could we reset WSMAN configuration ?

Answer 1

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query.

According to this article https://learn.microsoft.com/en-us/powershell/module/microsoft.wsman.management/about/about_wsman_provider?view=powershell-7.3

The WSMan provider for PowerShell lets you add, change, clear, and delete WS-Management configuration data on local or remote computers.

To return to defaults, use the following command.

At a command prompt, enter winrm invoke Restore winrm/config @ to return to the default settings.

Restart the service after adding any further custom configuration options. Using the Services MMC snap-in, restart the WinRM service as follows:

1. Press the Start key.
2. Simply select Control Panel.
3. To access System and Maintenance, click.
4. Simply select Administrative Tools.
5. To launch the Services Microsoft Management Console (MMC) snap-in, click Services.
6. When using the Services MMC snap-in, look for Windows Remote Management (WS-Management) in the list of service names.
7. To restart the service, right-click the Windows Remote Management (WS-Management) service name and choose Restart.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

Answer 2

Hi, look here -> https://www.facct.ru/blog/winrm-incident-response/