Windows Event ID 3002 – WinRM: WinRM Service Configuration Error

Start by verifying the WinRM service status and examining basic configuration parameters.

1. Open PowerShell as Administrator and check the WinRM service status:

   Get-Service WinRM
   Get-WinRMListener

2. Review the current WinRM configuration:

   winrm get winrm/config

3. Check for obvious configuration errors in Event Viewer → Applications and Services Logs → Microsoft → Windows → WinRM → Operational
4. Examine the detailed error message in Event ID 3002 for specific error codes and configuration paths
5. Restart the WinRM service to attempt automatic recovery:

   Restart-Service WinRM -Force

Reset the WinRM configuration to factory defaults to eliminate corrupted settings.

1. Stop the WinRM service:

   Stop-Service WinRM

2. Reset WinRM configuration to defaults:

   winrm quickconfig -force
   winrm set winrm/config/service @{AllowUnencrypted="false"}

3. Remove all existing listeners and recreate them:

   Get-WSManInstance -ResourceURI winrm/config/listener -Enumerate | Remove-WSManInstance
   New-WSManInstance -ResourceURI winrm/config/listener -SelectorSet @{Address="*";Transport="HTTP"} -ValueSet @{Port="5985"}

4. Configure Windows Firewall rules:

   Enable-NetFirewallRule -DisplayGroup "Windows Remote Management"

5. Start the WinRM service and verify operation:

   Start-Service WinRM
   Test-WSMan localhost

Address SSL certificate problems that commonly cause Event ID 3002 in HTTPS listeners.

1. List all WinRM listeners and identify HTTPS configurations:

   winrm enumerate winrm/config/listener

2. Check certificate bindings for WinRM ports:

   netsh http show sslcert

3. Examine certificate validity in the certificate store:

   Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*$(hostname)*"}

4. Remove invalid certificate bindings:

   netsh http delete sslcert ipport=0.0.0.0:5986

5. Create a new self-signed certificate and bind it to WinRM:

   $cert = New-SelfSignedCertificate -DnsName $(hostname) -CertStoreLocation Cert:\LocalMachine\My
   winrm create winrm/config/listener?Address=*+Transport=HTTPS @{Hostname="$(hostname)";CertificateThumbprint="$($cert.Thumbprint)"}

6. Verify the HTTPS listener is working:

   Test-WSMan -UseSSL

Fix corrupted WinRM registry entries that prevent proper service initialization.

1. Navigate to the WinRM registry location and backup current settings:

   reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN" C:\temp\winrm_backup.reg

2. Check for corrupted registry values in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service
3. Reset critical registry values to defaults:

   reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service" /v "allow_unencrypted" /t REG_DWORD /d 0 /f
   reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service" /v "auth_basic" /t REG_DWORD /d 0 /f

4. Remove corrupted listener configurations:

   reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Listener" /f

5. Restart the WinRM service to rebuild registry entries:

   Restart-Service WinRM

6. Verify registry reconstruction by checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Listener for new entries

Enable detailed logging and perform network-level troubleshooting for persistent Event ID 3002 issues.

1. Enable WinRM debug logging:

   wevtutil sl Microsoft-Windows-WinRM/Analytic /e:true
   wevtutil sl Microsoft-Windows-WinRM/Debug /e:true

2. Configure verbose WinRM logging in the registry:

   reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service" /v "LogLevel" /t REG_DWORD /d 3 /f

3. Reproduce the error and capture detailed logs:

   Get-WinEvent -LogName "Microsoft-Windows-WinRM/Operational" -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

4. Analyze network connectivity and port availability:

   Test-NetConnection -ComputerName localhost -Port 5985
   Test-NetConnection -ComputerName localhost -Port 5986
   netstat -an | findstr :598

5. Check for conflicting services using WinRM ports:

   Get-Process | Where-Object {$_.ProcessName -eq "svchost"} | ForEach-Object {Get-NetTCPConnection -OwningProcess $_.Id -ErrorAction SilentlyContinue | Where-Object {$_.LocalPort -in @(5985,5986)}}

6. Perform a complete WinRM service reset with logging enabled:

   winrm quickconfig -transport:https
   winrm set winrm/config/service/auth @{Basic="false";Kerberos="true";Negotiate="true";Certificate="false";CredSSP="false"}