WinRM HTTP/HTTPS Listener Binding Collisions with IIS Web Services

Question

Installing an internal management web service on an application server broke the host's WinRM remote management interface because IIS bound wildcard listeners (0.0.0.0:443) that intercepted WinRM HTTPS traffic. How do we configure explicit IP listen lists (httpcfg / netsh) to isolate WinRM endpoints

Answer 1

Hello Ahmad,

Yes. Bind WinRM and IIS to separate IPs instead of using wildcard listeners.

winrm enumerate winrm/config/listener

winrm delete winrm/config/Listener?Address=*+Transport=HTTPS

winrm create winrm/config/Listener?Address=IP:<WinRM_IP>+Transport=HTTPS @{Hostname="<FQDN>";CertificateThumbprint="<Thumbprint>"}

If needed, restrict HTTP.sys to specific addresses:

netsh http add iplisten ipaddress=<WinRM_IP>

netsh http show iplisten

Then change the IIS binding from *:443 to a dedicated application IP. The best practice is to avoid wildcard HTTPS bindings and keep WinRM and IIS on separate IPs to prevent HTTP.sys listener conflicts.