remote management question

Question

remote management question

Joseph Carson 0

should i be concerned about remote management operations in my event viewer

Joseph Carson 0 Reputation points

2024-01-31T06:50:43.9266667+00:00

just noticed a section of Event Viewer called 'Windows Remote Management'; I have Remote Desktop and Remote Connections disabled in the Settings, I also have Remote Shell Access and stuff like that disabled in Group Policy, and I have Remote Desktop Service + WinRM disabled in Services I don't utilize or like Remote features so I just tend to disable them; however, there are events logged in Windows Remote Management within Event Viewer in Applications and Services > Microsoft > Windows > Windows Remote Management > Operational They happen fairly regularly it seems throughout the day, with 4 events per occurrence, and they occur in this order: -Information Event 145 (WSMan API Call) - WSMan operation Enumeration started with resourceUri -Information Event 254 (None) - Activity Transfer -Error Event 161 (User Authentication) - The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WSManagement service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig" -Error Event 142 (Response Handling) - WSMan operation Enumeration failed with error code 2150858770 The event User is logged as "System", and the Security ID does seem to check out with that. I'm wondering why this occurs or if anyone else see these kinds of logs even with Remote settings disabled, every hour or 2? is it just Windows doing things? is this something I need to concern myself over?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

1 answer

Your answer

Joseph Carson 0 Reputation points

2024-01-31T06:50:43.9266667+00:00

just noticed a section of Event Viewer called 'Windows Remote Management'; I have Remote Desktop and Remote Connections disabled in the Settings, I also have Remote Shell Access and stuff like that disabled in Group Policy, and I have Remote Desktop Service + WinRM disabled in Services I don't utilize or like Remote features so I just tend to disable them; however, there are events logged in Windows Remote Management within Event Viewer in Applications and Services > Microsoft > Windows > Windows Remote Management > Operational They happen fairly regularly it seems throughout the day, with 4 events per occurrence, and they occur in this order: -Information Event 145 (WSMan API Call) - WSMan operation Enumeration started with resourceUri -Information Event 254 (None) - Activity Transfer -Error Event 161 (User Authentication) - The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WSManagement service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig" -Error Event 142 (Response Handling) - WSMan operation Enumeration failed with error code 2150858770 The event User is logged as "System", and the Security ID does seem to check out with that. I'm wondering why this occurs or if anyone else see these kinds of logs even with Remote settings disabled, every hour or 2? is it just Windows doing things? is this something I need to concern myself over?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Hello, In general, information event can be safely ignored if there is no specific problem of your system. Besides, the error event 254, 161, 142 may be casued by the function disabling. You may use Process Monitor to capture process detail logs for further identification.

---If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

remote management question

1 answer

Your answer