PowerShell WinRM

WinRM is the service that carries PowerShell remoting on Windows. If remoting fails, WinRM is the first thing to check.

Lesson 3 min read Windows PowerShell 5.1 and PowerShell 7

Written and tested by Dhrub Bharali · Updated 02 October 2026

Overview

Enable-PSRemoting -Force sets it up: it starts the service, sets it to automatic, creates the listener and opens the firewall rule. On a domain-joined machine that is usually all that is needed. Test-WSMan against the target confirms the endpoint answers, and it is a much better first test than trying your real command.

The failures cluster into a few causes. The service is stopped. There is no listener, which winrm enumerate winrm/config/listener will show. The firewall blocks TCP 5985 for HTTP or 5986 for HTTPS. Or the network profile is Public, which makes Enable-PSRemoting refuse until you pass -SkipNetworkProfileCheck. That switch tells PowerShell to enable remoting even on a Public (untrusted) network profile — only use it when you know the network is safe, because it opens the remoting listener where anyone on that network can reach it.

Workgroup machines add one more step. Without a domain, Kerberos is unavailable, so the client needs the target in its TrustedHosts list and you must pass explicit credentials. TrustedHosts is a client-side setting, which people frequently set on the wrong machine. And be clear about what it does not do: adding a host to TrustedHosts does not authenticate that machine — it tells your client to skip the mutual-authentication check it would otherwise require, so a machine pretending to be your target would be trusted too. Use it for lab and workgroup machines you control, never as a blanket entry.

What happens

This checks the local WinRM service. Status tells you whether it is running now, and StartType tells you whether it will come back after a reboot. A service that is Running but set to Manual will work today and fail after the next restart, which is a failure mode worth catching before it catches you.

Worth remembering

Enable-PSRemoting -Force configures the service, listener and firewall.
Test-WSMan is the cheapest way to confirm the endpoint answers.
Port 5985 is the HTTP listener and 5986 is the HTTPS listener. HTTP traffic — including your credentials — crosses the network unencrypted; HTTPS encrypts it. Prefer 5986 outside a trusted network.
TrustedHosts is set on the client, and only needed outside a domain.

Primary documentation

Select-Object reference · Get-Service reference

Try it

Browser simulation · fictional data; no changes to your computer.

Command

Interactive simulation · fictional data

Checks whether WinRM is running and whether it starts automatically.

Show reference output

Sample output · fictional data, shaped like the real thing

Name   Status   StartType
-----  -------  ---------
WinRM  Stopped  Manual

Practise this

Check the remote management endpoint

Run Test-WSMan against lab-server and return its fictional identity response.

Review the lesson

Keep going

Next: PowerShell SSH remoting