Windows Event ID 8230 – WinRM: WS-Management Service Authentication Error

Start by examining the complete authentication failure details in Event Viewer to understand the specific error context.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Applications and Services Logs → Microsoft → Windows → WinRM → Operational
3. Filter for Event ID 8230 by right-clicking the log and selecting Filter Current Log
4. Review the event details, noting the client IP address, authentication method, and error code
5. Cross-reference with Security logs by navigating to Windows Logs → Security and filtering for Event IDs 4624 (successful logon) and 4625 (failed logon) from the same timeframe

# PowerShell command to retrieve Event ID 8230 details
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WinRM/Operational'; Id=8230} -MaxEvents 10 | Format-List TimeCreated, Id, LevelDisplayName, Message

Verify WinRM service status and test authentication from the client side to isolate the connection issue.

1. On the target server, check WinRM service status and configuration:

# Check WinRM service status
Get-Service WinRM

# Display current WinRM configuration
winrm get winrm/config

# Check authentication methods enabled
winrm get winrm/config/service/auth

2. From the client machine, test basic connectivity to the WinRM service:

# Test WinRM connectivity (replace SERVER-NAME with actual server)
Test-WSMan -ComputerName SERVER-NAME

# Test with specific authentication
Test-WSMan -ComputerName SERVER-NAME -Authentication Kerberos

# Attempt PowerShell remoting session
Enter-PSSession -ComputerName SERVER-NAME -Credential (Get-Credential)

3. If authentication fails, enable WinRM logging for detailed diagnostics:

# Enable WinRM analytic logging
wevtutil sl Microsoft-Windows-WinRM/Analytic /e:true

# Reproduce the issue, then check analytic logs
Get-WinEvent -LogName 'Microsoft-Windows-WinRM/Analytic' -MaxEvents 20

Adjust WinRM authentication configuration to resolve compatibility issues and establish proper trust relationships.

1. Configure WinRM to allow the required authentication methods:

# Enable basic authentication (use cautiously in production)
winrm set winrm/config/service/auth @{Basic="true"}

# Enable Kerberos authentication
winrm set winrm/config/service/auth @{Kerberos="true"}

# Enable NTLM authentication
winrm set winrm/config/service/auth @{Negotiate="true"}

2. Configure trusted hosts for workgroup or cross-domain scenarios:

# Add specific host to trusted hosts list
winrm set winrm/config/client @{TrustedHosts="SERVER-NAME"}

# Add multiple hosts or use wildcards (less secure)
winrm set winrm/config/client @{TrustedHosts="SERVER1,SERVER2,*.domain.com"}

# View current trusted hosts configuration
winrm get winrm/config/client

3. Restart WinRM service to apply configuration changes:

# Restart WinRM service
Restart-Service WinRM -Force

# Verify service is running and listening
Get-Service WinRM
netstat -an | findstr :5985

4. Test the connection again with verbose output:

# Test with verbose output to see authentication details
$PSSessionOption = New-PSSessionOption -IncludePortInSPN
Enter-PSSession -ComputerName SERVER-NAME -SessionOption $PSSessionOption -Credential (Get-Credential)

Address Kerberos-specific authentication problems that commonly cause Event ID 8230 in domain environments.

1. Verify time synchronization between client and server (critical for Kerberos):

# Check current time and time source
w32tm /query /status
w32tm /query /peers

# Force time synchronization with domain controller
w32tm /resync /force

2. Clear and regenerate Kerberos tickets:

# Display current Kerberos tickets
klist

# Purge all Kerberos tickets
klist purge

# Request new ticket for target server
klist get krbtgt
klist get HOST/SERVER-NAME

3. Check and configure Service Principal Names (SPNs) for WinRM:

# Check existing SPNs for the server
setspn -L SERVER-NAME

# Add WinRM SPNs if missing (run as domain admin)
setspn -A WSMAN/SERVER-NAME SERVER-NAME
setspn -A WSMAN/SERVER-NAME.domain.com SERVER-NAME

4. Verify domain controller connectivity and DNS resolution:

# Test domain controller connectivity
nltest /dsgetdc:domain.com

# Verify DNS resolution for target server
nslookup SERVER-NAME
nslookup SERVER-NAME.domain.com

# Test LDAP connectivity to domain controller
ldp.exe

Perform deep-level analysis using network captures and registry examination for complex authentication scenarios.

1. Enable WinRM debug logging through registry modification:

# Enable WinRM debug logging (requires restart)
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service" -Name "LogLevel" -Value 65535 -PropertyType DWord -Force

# Set log file location
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service" -Name "LogFile" -Value "C:\Windows\Temp\WinRM.log" -PropertyType String -Force

2. Capture network traffic during authentication attempts:

# Start network capture using netsh (run as administrator)
netsh trace start capture=yes tracefile=C:\temp\winrm_auth.etl provider=Microsoft-Windows-WinRM

# Reproduce the authentication failure
# Stop the trace
netsh trace stop

# Convert ETL to readable format
netsh trace convert input=C:\temp\winrm_auth.etl output=C:\temp\winrm_auth.txt

3. Analyze authentication-related registry settings:

# Check WinRM service registry settings
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service"

# Examine authentication provider settings
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell"

# Check local security policy settings affecting WinRM
secedit /export /cfg C:\temp\secpol.cfg
Get-Content C:\temp\secpol.cfg | Select-String -Pattern "SeDenyNetworkLogonRight|SeNetworkLogonRight"

4. Use PowerShell Desired State Configuration (DSC) to ensure consistent WinRM configuration:

# Create DSC configuration for WinRM settings
Configuration WinRMConfig {
    Node localhost {
        Service WinRM {
            Name = "WinRM"
            State = "Running"
            StartupType = "Automatic"
        }
        
        Registry WinRMAuth {
            Key = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service"
            ValueName = "AllowUnencrypted"
            ValueData = "0"
            ValueType = "Dword"
        }
    }
}

# Apply the configuration
WinRMConfig
Start-DscConfiguration -Path .\WinRMConfig -Wait -Verbose