Windows Event ID 3603 – WinRM: Remote Management Service Authentication Error

Start by checking the WinRM service status and basic configuration on both client and target systems.

Step 1: Open PowerShell as Administrator and check WinRM service status:

Get-Service WinRM
Get-WSManInstance -ResourceURI winrm/config

Step 2: Verify WinRM is properly configured for remoting:

winrm quickconfig
winrm get winrm/config

Step 3: Check Event Viewer for detailed error information:

Navigate to Event Viewer → Applications and Services Logs → Microsoft → Windows → WinRM → Operational

Step 4: Test basic connectivity to the target system:

Test-WSMan -ComputerName TargetServer
Test-NetConnection -ComputerName TargetServer -Port 5985

Examine the specific authentication method failing and verify credential validity.

Step 1: Check which authentication methods are enabled:

Get-WSManInstance -ResourceURI winrm/config/service/auth
Get-WSManInstance -ResourceURI winrm/config/client/auth

Step 2: Test different authentication methods explicitly:

# Test with explicit credentials
$cred = Get-Credential
Enter-PSSession -ComputerName TargetServer -Credential $cred -Authentication Kerberos

# Test NTLM authentication
Enter-PSSession -ComputerName TargetServer -Credential $cred -Authentication NTLM

Step 3: Verify domain trust and time synchronization:

nltest /query /domain:YourDomain
w32tm /query /status
w32tm /resync

Step 4: Check for Kerberos ticket issues:

klist
klist purge
# Re-authenticate and test again

Address Kerberos authentication failures by verifying and configuring Service Principal Names.

Step 1: Check existing SPNs for the target computer:

setspn -L TargetServer$
setspn -Q HTTP/TargetServer
setspn -Q HTTP/TargetServer.domain.com

Step 2: Register missing SPNs if not found:

# Register SPNs for the computer account
setspn -S HTTP/TargetServer TargetServer$
setspn -S HTTP/TargetServer.domain.com TargetServer$
setspn -S WSMAN/TargetServer TargetServer$
setspn -S WSMAN/TargetServer.domain.com TargetServer$

Step 3: Verify SPN registration was successful:

setspn -L TargetServer$
# Look for HTTP and WSMAN entries

Step 4: Test Kerberos authentication after SPN registration:

Test-WSMan -ComputerName TargetServer -Authentication Kerberos
Enter-PSSession -ComputerName TargetServer -Authentication Kerberos

Step 5: Check for duplicate SPNs that might cause conflicts:

setspn -X -F

Resolve certificate authentication issues by verifying certificate validity and trust chains.

Step 1: Check WinRM HTTPS listener configuration:

winrm enumerate winrm/config/listener
# Look for HTTPS transport entries

Step 2: Verify certificate in the local machine certificate store:

Get-ChildItem -Path Cert:\LocalMachine\My
# Check for certificates with Server Authentication usage

Step 3: Create HTTPS listener if missing:

# Find appropriate certificate thumbprint
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*$env:COMPUTERNAME*"}

# Create HTTPS listener
winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="$env:COMPUTERNAME"; CertificateThumbprint="$($cert.Thumbprint)"}

Step 4: Test HTTPS connectivity:

Test-WSMan -ComputerName TargetServer -UseSSL
Test-NetConnection -ComputerName TargetServer -Port 5986

Step 5: Verify certificate trust chain:

# Check certificate chain validation
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Thumbprint -eq "YourCertThumbprint"}
$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
$chain.Build($cert)

Enable detailed WinRM logging and perform network-level troubleshooting for complex authentication issues.

Step 1: Enable WinRM analytic and debug logging:

# Enable WinRM operational logging
wevtutil sl Microsoft-Windows-WinRM/Operational /e:true

# Enable analytic logging for detailed troubleshooting
wevtutil sl Microsoft-Windows-WinRM/Analytic /e:true
wevtutil sl Microsoft-Windows-WinRM/Debug /e:true

Step 2: Configure WinRM client logging:

winrm set winrm/config/client @{LoggingLevel="Verbose"}
winrm set winrm/config/service @{LoggingLevel="Verbose"}

Step 3: Monitor authentication attempts in real-time:

# Monitor WinRM events during authentication attempts
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WinRM/Operational'; StartTime=(Get-Date).AddMinutes(-5)} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Step 4: Analyze network traffic with netsh:

# Start network trace
netsh trace start capture=yes provider=Microsoft-Windows-WinRM tracefile=winrm_trace.etl

# Reproduce the authentication issue
# Stop trace
netsh trace stop

Step 5: Check Group Policy settings affecting WinRM:

Navigate to Group Policy Editor → Computer Configuration → Administrative Templates → Windows Components → Windows Remote Management (WinRM)

# Query relevant registry keys
Get-ItemProperty -Path "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service" -ErrorAction SilentlyContinue
Get-ItemProperty -Path "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client" -ErrorAction SilentlyContinue