17

I am trying to enable Powershell remoting on a Windows 2008 R2 Server, running in workgroup mode.

I ran the command Enable-PSRemoting in the PowerShell Console.

PS C:\Windows\system32> Enable-PSRemoting

WinRM Quick Configuration Running command "Set-WSManQuickConfig" to enable this machine for remote management through WinRM service  This includes:
    1. Starting or restarting (if already started) the WinRM service
    2. Setting the WinRM service type to auto start
    3. Creating a listener to accept requests on any IP address
    4. Enabling firewall exception for WS-Management traffic (for http only).

Do you want to continue? [Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y WinRM already is set up to receive requests on this machine. Set-WSManQuickConfig : Access is denied. At line:50 char:33
+             Set-WSManQuickConfig <<<<  -force
    + CategoryInfo          : InvalidOperation: (:) [Set-WSManQuickConfig], InvalidOperationException
    + FullyQualifiedErrorId : WsManError,Microsoft.WSMan.Management.SetWSManQuickConfigCommand

I am logged in as a member of the Administrators Group, and running the Console As Administrator.

Nic
  • 13,025
  • 16
  • 59
  • 102
  • can you try run "winrm quickconfig" from command line (not PowerShell). I believe it's doing exactly the same as Enable-PSRemoting in PowerShell –  Nov 28 '11 at 08:08
  • It gives the same result: Access is denied –  Nov 28 '11 at 22:54
  • 2
    Why was this closed as off-topic, running Powershell scripts on remote servers seems very much within the scope of Stackoverflow! –  Dec 01 '11 at 15:49
  • @Peter Lundsby - Probably because if you have the right command, but it's not working on the server, that's more a server issue than a programming one. – Driftpeasant Dec 05 '11 at 21:39

6 Answers6

19

Just ran into and solved this problem on a couple of systems. In this particular case, these two systems were not part of a domain, and the user account was not the original "Administrator" account, but rather a newer account that was also a member of the local Administrators group.

The solution came from the following blog post I wandered across: WinRM Access is Denied on Local Computer. In short, run the following from a command prompt (launched as Administrator):

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

After that, re-launch the PowerShell prompt as admin and re-run Enable-PSRemoting, that simple.

ChrisW
  • 3
  • 2
Karl M. Davis
  • 311
  • 2
  • 3
  • 1
    PoSH Check: `Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ -Name LocalAccountTokenFilterPolicy` PoSH Set: `Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ -Name LocalAccountTokenFilterPolicy -Value 1` – mlhDev Apr 01 '20 at 18:25
11

For any issue with Power Shell Remoting, there are two important resources.

The first is help about_Remote_Troubleshooting, which is an extensive reference.

The second is an internet search for the error you're getting. I found a PowerShell team blog post that had this checklist:

  1. My machine is connected to domain.
  2. I am logged in as administrator
  3. PowerShell is launched elevated.
  4. My password is not blank

Does one of those fix your issue?

Jay Bazuzi
  • 663
  • 5
  • 14
6

I recently had the same error Access is denied, while trying to enable PSRemoting on hosted version of Windows 2008 R2.

I discovered that my hosting company had applied a group policy on a firewall rule, which is modified in the 4th step when trying to enabled PSRemoting:
4. Enabling firewall exception for WS-Management traffic (for http only)


Steps to fix:
1) Click on start menu >> Administrative tools >> Windows Firewall and Advanced security

2) Click on inbound rules >> new rule >> choose the option "predefined" and select Windows Remote Management from the dropdown list >> Click next

3) Now, Deselect Windows Remote Management compatibility Mode(HTTP-In) and select Windows Remote Management Mode(HTTP-In) >> Click Next >> Allow the connection >> Finish


Here's a list of useful resources for debugging this, which I used before I discovered the above fix:

Trouble Shooting References:
Check that your account is in the Local Administrators group:

powershell> whoami /all

Powershell team - Enable PSRemoting (4 common trouble shooting steps)
How to run powershell commands on remote computers (Domain vs Workgroup setup)

Other Topics:
Trying to setup PSRemoting on SharePoint?
Using PowerShell remoting technologies to manage a SharePoint farm

Trying to setup PSRemoting on Windows XP?
Error enabling PSRemoting in Windows XP SP3

Are you setting up PSRemoting on a non English computer? - change it to English
Reference 1 - lanuage not specified
Reference 2 - Spanish/German

Are you using VirtualBox and trying to setup PSRemoting?
Virtualbox and needing to enable enable CredSSP
VirtualBox and setting up PSRemoting gets access denied error

Ralph Willgoss
  • 215
  • 2
  • 5
0
  1. Verify Powershell version is greater than 3.0 Check to upgrade WMF (windows management framework) to 4.0 or to 5.1
  2. FW off or at least windows remote (inbound) rules are on and public.
  3. Verify windows remote service is running in "automatic"
  4. Verify port 5985 is listening (netstat -noa)
  5. Verify no antivirus FW is blocking
Gabriella
  • 1
0

Sometimes problem with winrm and "access denied" caused by invalid certificates configuration. There is here details: https://docs.microsoft.com/en-us/troubleshoot/iis/http-403-forbidden-access-website#cause-2-non-self-signed-certificates-are-in-trusted-root-certification-authorities-certificate-store

Alexey Gusarov
  • 101
-2

I turned off UAC in Win 7, rebooted and it worked.

Edit: Not suggesting you leave UAC off. I had this issue and did not have a blank password. Turned out to be the only fix for me. Just turn it back on when the command succeeds. Sheesh on the downvotes. lol

Roger Guess
  • 263
  • 1
  • 4
  • 11
  • 9
    turning off UAC should never be an option. – Peter Hahndorf May 17 '15 at 16:58
  • Agree, and I am not suggesting you leave it off. Someone should tell microsoft to fix it. All I provided was the work around (obviously not a popular one). I ran the needed command, and then turned UAC back on. – Roger Guess May 18 '15 at 15:20
  • http://blogs.msdn.com/b/vistacompatteam/archive/2006/09/22/766945.aspx – Edd Nov 05 '15 at 17:30