Windows Event ID 1040 – Microsoft-Windows-WinRM: WinRM Service Started Successfully

Check the current WinRM service status and basic configuration to confirm successful startup.

1. Open PowerShell as Administrator and verify service status:

   Get-Service WinRM
   Get-WinRMConfiguration

2. Check WinRM listeners and configuration:

   winrm enumerate winrm/config/listener
   winrm get winrm/config

3. Navigate to Event Viewer → Applications and Services Logs → Microsoft → Windows → WinRM → Operational
4. Filter for Event ID 1040 to confirm successful service starts:

   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WinRM/Operational'; Id=1040} -MaxEvents 5

5. Verify the service startup type in Services console: services.msc → locate Windows Remote Management (WS-Management)

Validate that WinRM is accepting connections and authentication is working properly.

1. Test local WinRM connectivity:

   Test-WSMan localhost
   Test-WSMan -ComputerName $env:COMPUTERNAME -Authentication Default

2. Check WinRM authentication methods:

   winrm get winrm/config/service/auth

3. Test PowerShell remoting locally:

   Enter-PSSession -ComputerName localhost
   Exit-PSSession

4. Verify firewall rules for WinRM:

   Get-NetFirewallRule -DisplayGroup "Windows Remote Management" | Select-Object DisplayName, Enabled, Direction

5. Check WinRM port bindings:

   netstat -an | findstr :5985
   netstat -an | findstr :5986

Examine detailed WinRM configuration and security settings to ensure optimal operation.

1. Export complete WinRM configuration:

   winrm get winrm/config | Out-File C:\temp\winrm-config.txt
   Get-WSManInstance -ResourceURI winrm/config -Enumerate

2. Check registry settings for WinRM:

   Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service" -ErrorAction SilentlyContinue

3. Verify certificate configuration for HTTPS listeners:

   Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*$env:COMPUTERNAME*"}
   winrm enumerate winrm/config/listener

4. Review Group Policy settings affecting WinRM:

   gpresult /h C:\temp\gpresult.html
   # Check Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Remote Management

5. Examine WinRM service dependencies:

   Get-Service WinRM | Select-Object -ExpandProperty ServicesDependedOn
   Get-Service WinRM | Select-Object -ExpandProperty DependentServices

Implement monitoring to track WinRM performance and identify potential issues.

1. Enable WinRM analytic logging for detailed troubleshooting:

   wevtutil sl Microsoft-Windows-WinRM/Analytic /e:true
   wevtutil sl Microsoft-Windows-WinRM/Debug /e:true

2. Monitor WinRM performance counters:

   Get-Counter "\WS-Management Listener(*)*" -MaxSamples 5
   Get-Counter "\WinRM Service\Active Shells" -Continuous

3. Track connection attempts and authentication events:

   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WinRM/Operational'; Id=91,142,143} -MaxEvents 20

4. Set up custom event log monitoring:

   Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.LogFile='Microsoft-Windows-WinRM/Operational' AND TargetInstance.EventCode=1040" -Action {Write-Host "WinRM Started: $(Get-Date)"}

5. Create a monitoring script for WinRM health:

   # Save as Monitor-WinRM.ps1
   while ($true) {
       $service = Get-Service WinRM
       $listeners = winrm enumerate winrm/config/listener 2>$null
       Write-Host "$(Get-Date): WinRM Status: $($service.Status), Listeners: $($listeners.Count)"
       Start-Sleep 300
   }

Perform advanced diagnostics and implement security best practices for WinRM.

1. Enable comprehensive WinRM logging and tracing:

   winrm set winrm/config/service @{EnableCompatibilityHttpListener="false"}
   winrm set winrm/config/service @{CertificateThumbprint=""}
   logman create trace WinRM-Trace -p Microsoft-Windows-WinRM -o C:\temp\winrm-trace.etl

2. Implement certificate-based authentication:

   # Create HTTPS listener with certificate
   $cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*$env:COMPUTERNAME*"} | Select-Object -First 1
   winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="$env:COMPUTERNAME"; CertificateThumbprint="$($cert.Thumbprint)"}

3. Configure advanced security settings:

   winrm set winrm/config/service/auth @{Basic="false"; Digest="false"; Kerberos="true"; Negotiate="true"; Certificate="true"}
   winrm set winrm/config/service @{AllowUnencrypted="false"}

4. Implement IP address restrictions:

   # Configure trusted hosts (use carefully)
   Set-Item WSMan:\localhost\Client\TrustedHosts -Value "192.168.1.*" -Force
   # Or use Group Policy for enterprise environments

5. Set up audit logging for WinRM access:

   auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
   # Check registry for audit settings
   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\Audit" -ErrorAction SilentlyContinue