Troubleshooting WinRM Connection Issues Between Specific Servers

Use this when WinRM works generally in the environment but fails between specific servers.

Quick Read

Symptom: Use this when WinRM works generally in the environment but fails between specific servers.
Check first: Ping the target server to ensure network connectivity.
Risk: Changes system state

WinRM cannot complete the operation from one server to another, while connections to other servers are successful.

Windows Server 2016/2019, WinRM configured and operational on all servers.

Potential network issues, firewall settings, or WinRM configuration discrepancies on the affected server.

Ping the target server to ensure network connectivity.
Verify WinRM service status on both source and target servers.
Check firewall rules on both servers for WinRM ports (default 5985 for HTTP, 5986 for HTTPS).

Ping the target server to check connectivity.
Use the ping command to verify that the source server can reach the target server.
Example pattern only. Adjust for your environment before running.
```
ping <target-server-IP-or-hostname>
```
Check the status of the WinRM service on both servers.
Ensure that the WinRM service is running on both the source and target servers.
Safe to run: read-only
```
Get-Service WinRM
```

Examine firewall settings on both servers.

Check if the firewall is blocking WinRM traffic on the target server.

Safe to run: read-only

Get-NetFirewallRule -DisplayName 'Windows Remote Management (HTTP-In)'
Get-NetFirewallRule -DisplayName 'Windows Remote Management (HTTPS-In)'

Test WinRM connectivity using the Test-WSMan command.
Use the Test-WSMan command to check if WinRM is properly configured on the target server.
Example pattern only. Adjust for your environment before running.
```
Test-WSMan <target-server-IP-or-hostname>
```
Review WinRM listener configuration.
Ensure that the WinRM listener is configured correctly on the target server.
Example pattern only. Adjust for your environment before running.
```
winrm enumerate winrm/config/listener
```
Check for any recent changes to the target server's configuration.
Look for any updates or configuration changes that may have affected WinRM.
Safe to run: read-only
```
Get-EventLog -LogName System -Newest 50
```

After performing the checks and fixes, attempt to connect using WinRM again.
Use the command 'Enter-PSSession -ComputerName <target-server-IP-or-hostname>' to validate the connection.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx for WinRM-specific logs.
C:\Windows\System32\winevt\Logs\System.evtx for general system logs.

If the issue persists after all checks and fixes, escalate to the network team for potential routing issues.
Contact the security team if firewall rules cannot be modified.