Windows Event ID 11707 – Microsoft-Windows-WinRM: WinRM Service Configuration Error

Start by verifying the WinRM service and its dependencies are running correctly.

1. Open PowerShell as Administrator and check service status:

   Get-Service WinRM, HTTP, RpcEptMapper | Select-Object Name, Status, StartType

2. If WinRM is stopped, attempt to start it:

   Start-Service WinRM -Verbose

3. Check for dependency failures:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=7000,7001,7034} -MaxEvents 20 | Where-Object {$_.Message -like '*WinRM*'}

4. Navigate to Services.msc → Windows Remote Management (WS-Management) → Dependencies tab to verify all required services are running
5. If HTTP service fails, restart it:

   net stop http /y
   net start http

Reset WinRM to factory defaults to resolve configuration corruption.

1. Stop the WinRM service:

   Stop-Service WinRM -Force

2. Reset WinRM configuration:

   winrm quickconfig -force
   winrm set winrm/config/client '@{TrustedHosts="*"}'

3. Restore default listeners:

   winrm delete winrm/config/listener?Address=*+Transport=HTTP
   winrm delete winrm/config/listener?Address=*+Transport=HTTPS
   winrm create winrm/config/listener?Address=*+Transport=HTTP

4. Verify configuration:

   winrm enumerate winrm/config/listener
   winrm get winrm/config

5. Test WinRM functionality:

   Test-WSMan localhost

Check authentication providers and certificate configurations that may cause WinRM failures.

1. Examine authentication settings:

   winrm get winrm/config/service/auth
   winrm get winrm/config/client/auth

2. Check for certificate issues in Event Viewer:Event Viewer → Applications and Services Logs → Microsoft → Windows → WinRM → Operational
3. Verify Kerberos functionality:

   klist tickets
   klist purge

4. Test NTLM authentication:

   winrm set winrm/config/service/auth '@{Basic="true";Kerberos="true";NTLM="true"}'

5. For certificate authentication, check certificate store:

   Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Subject -like '*' -and $_.NotAfter -gt (Get-Date)}

6. Regenerate self-signed certificate if needed:

   New-SelfSignedCertificate -DnsName $env:COMPUTERNAME -CertStoreLocation Cert:\LocalMachine\My

Investigate registry corruption and Group Policy conflicts affecting WinRM.

1. Check WinRM registry keys for corruption:

   Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN'
   Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\*'

2. Examine Group Policy settings:

   gpresult /h GPReport.html
   Get-GPResultantSetOfPolicy -ReportType Html -Path WinRMPolicy.html

3. Check for conflicting policies in registry:HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM
4. Reset WinRM registry if corrupted:

   Remove-Item 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN' -Recurse -Force
   Restart-Service WinRM

5. Force Group Policy refresh:

   gpupdate /force
   Invoke-GPUpdate -Force

6. Verify policy application:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502,1503} -MaxEvents 10

Perform comprehensive network and firewall analysis for complex WinRM issues.

1. Check firewall rules for WinRM:

   Get-NetFirewallRule -DisplayGroup 'Windows Remote Management' | Select-Object DisplayName, Enabled, Direction
   Get-NetFirewallPortFilter -Protocol TCP | Where-Object {$_.LocalPort -eq 5985 -or $_.LocalPort -eq 5986}

2. Test network connectivity:

   Test-NetConnection -ComputerName localhost -Port 5985
   Test-NetConnection -ComputerName localhost -Port 5986

3. Enable WinRM detailed logging:

   wevtutil set-log Microsoft-Windows-WinRM/Analytic /enabled:true
   wevtutil set-log Microsoft-Windows-WinRM/Debug /enabled:true

4. Monitor network traffic:

   netstat -an | findstr :5985
   netstat -an | findstr :5986

5. Check HTTP.sys configuration:

   netsh http show urlacl
   netsh http show sslcert

6. Analyze detailed event logs:

   Get-WinEvent -LogName Microsoft-Windows-WinRM/Analytic -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

7. Reset network stack if necessary:

   netsh winsock reset
   netsh int ip reset