Query on WinRM

Glenn Maxwell 11,476 Reputation points
2023-12-28T15:12:55.2633333+00:00

Hi All

I have below ask to restrict WinRM i.e Restrict WinRM from Storing RunAs Credentials on Windows Servers.

-Computer Configuration Policies-Administrative Templates-Windows Components-Windows Remote Management(WinRM)\WinRM Service-->Disallow WinRM from storing RunAs credentials-->Enabled

-Computer Configuration-Policies-Administrative Templates-Windows Components-Windows Remote Management (WinRM)\WinRM Client-->Disallow Digest authentication-->Enabled

if i enable these settings what kind of issues i can come across, please guide me.from one server will i be able to connect to another server using powershell or run remote powershell scripts.

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,780 questions
Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,520 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,187 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,544 questions
PowerShell
PowerShell
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
2,566 questions
0 comments No comments
{count} votes

Accepted answer
  1. glebgreenspan 2,235 Reputation points
    2023-12-28T15:26:33.5166667+00:00

    Hey Glenn

    Here are the potential issues you may come across.

    Tested before you put on prod.

    it may require adjustments to how you establish remote PowerShell connections, provide credentials, and modify existing scripts or tools to ensure compatibility.

    Unable to store RunAs credentials: When you enable the setting "Disallow WinRM from storing RunAs credentials," WinRM on the servers will no longer store the credentials used for RunAs operations. This means that you will need to provide the username and password each time you establish a remote PowerShell session or run PowerShell commands/scripts remotely using different credentials.

    Limited authentication options: Enabling the setting "Disallow Digest authentication" means that the Digest authentication mechanism will be disabled for WinRM. Digest authentication provides a level of security and is commonly used, so disabling it may limit the available authentication options for remote connections. This may require you to use alternative authentication methods such as Kerberos or Negotiate.

    Impact on remote PowerShell sessions: If the credentials are not stored and Digest authentication is disabled, establishing remote PowerShell sessions to other servers may require you to provide explicit credentials each time you connect. This can be cumbersome if you need to make frequent connections to different servers. You may also need to modify your PowerShell scripts to include the necessary credential prompts or handle remote connections explicitly.

    Compatibility with existing scripts and tools: Any existing PowerShell scripts or tools that rely on stored credentials or use Digest authentication for WinRM connections may no longer work as expected or require modifications. Make sure to test your scripts and tools to ensure compatibility with the new settings.

    0 comments No comments

2 additional answers

Sort by: Most helpful
  1. Glenn Maxwell 11,476 Reputation points
    2023-12-28T17:00:36.2966667+00:00

    i have few powershell scripts running daily on few servers through task scheduler with a service account credentials. will those tasks run daily

    0 comments No comments

  2. Glenn Maxwell 11,476 Reputation points
    2024-01-26T17:32:53.81+00:00

    i am unable to mark as answer


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.