How to enable negotiate authentication for winrm

Question

I have disabled negotiate authentication for the winrm service on my server by executing:

winrm put winrm/config/service/Auth @{Negotiate="false"}

And now I can perform any operation with winrm. I get the error:

    Message = The WinRM client cannot process the request. The WinRM client trie
d to use Negotiate authentication mechanism, but the destination computer (local
host:47001) returned an 'access denied' error. Change the configuration to allow
 Negotiate authentication mechanism to be used or specify one of the authenticat
ion mechanisms supported by the server. To use Kerberos, specify the local compu
ter name as the remote destination. Also verify that the client computer and the
 destination computer are joined to a domain. To use Basic, specify the local co
mputer name as the remote destination, specify Basic authentication and provide
user name and password. Possible authentication mechanisms reported by server:

I understand the error, but the problem is that the only way I find on the web to enable Negotiate authentication is by executing:

winrm put winrm/config/service/Auth @{Negotiate="true"}

Which of course gives the error above. Is there another way to enable Negotiate authentication?

score 14 · Accepted Answer · answered Nov 01 '13 at 11:36

14

Use Group Policy:

Computer > Policies > Administrative Templates > Windows Components > Windows Remote Management > WinRM Service:
Disallow Negotiate Authentication: Disabled.

answered Nov 01 '13 at 11:36

Greg Askew

34,339
3
52
81

5

For future readers: to open this menu run(win + 'R') `gpedit.msc` and select `Computer Configuration` -> `Administrative Templates` ... – Ivaylo Strandjev Nov 12 '13 at 09:12
If it's "not configured", don't let that fool you; it's not actually picking up the default as you'd expect. This ended up being the answer for me after unsuccessfully trying the registry fixes. – durette Jun 28 '18 at 20:33

score 6 · Answer 2 · edited Jan 01 '15 at 09:57

6

Edit the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Client.

Set auth_kerberos and auth_negotiate to 1.

Restart the service.

edited Jan 01 '15 at 09:57

Andrew Schulman

8,561
21
31
47

answered Jan 01 '15 at 09:48

Ivan

171
1
3

score 2 · Answer 3 · edited May 19 '17 at 01:03

2

As suggested in this answer, but Service, not Client:

Edit the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service.
Set auth_kerberos and auth_negotiate to 1.
Restart the Windows Remote Management (WS-Management) Service.

edited May 19 '17 at 01:03

I say Reinstate Monica

3,100
7
23
51

answered May 18 '17 at 23:43

lcapty507

21
2

score 1 · Answer 4 · edited Jun 24 '15 at 14:16

1

On our server 2012 / exchange 2010 machine we had this error when trying to use AVG backup software.

I found removing both maxenvelopesize and trusted_hosts under this key did the trick

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Client]
"maxEnvelopeSize"=dword:000007d0
"trusted_hosts"="*"

edited Jun 24 '15 at 14:16

sebix

4,175
2
25
45

answered Jun 24 '15 at 10:36

rob

11
2

score 1 · Answer 5 · edited Aug 03 '16 at 06:49

I had one server working, yet another would not. I could not find the problem. Finally I figured it out.

On the sending server: set the local policy Computer Configuration\Administrative Templates\System\Credentials Delegation\Allow Delegating Fresh Credentials. In there, set WSMAN* in the Add servers to the list (also check the box to Concatenate OS defaults)

On the receiving server (Create a .reg file with the following:):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Client] 
"auth_credssp"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service]
"auth_credssp"=dword:00000001

works for me

score 1 · Answer 6 · answered Nov 15 '19 at 22:43

Please note that if the computer (server) is a member of domain, or itself is a domain controller (in my case Windows Server 2019), the Group Policy can be applied from domain group policy.
So I suggest (in these cases) use below command and check the "Disallow Negotiate authentication" policy winning value.

C:\Temp\gpresult /h rep.htm

It may be applied from "Default Domain Controllers Policy" !!

How to enable negotiate authentication for winrm

6 Answers6