How to fix "The WinRM client cannot process the request. The following flags cannot be specified together: WSManFlagUseClientCertificate and WSManFlagCredUsernamePassword."

Description

This Windows Remote Management (WinRM) error occurs because your connection configuration is trying to use two mutually exclusive authentication methods at the same time.

• WSManFlagUseClientCertificate tells WinRM to authenticate using a cryptographic client certificate.
• WSManFlagCredUsernamePassword tells WinRM to authenticate using a standard username and password (Basic, CredSSP, or Negotiate authentication).

Windows security protocols prohibit using a certificate and a plaintext credential pair simultaneously for a single WinRM session. You must choose one authentication method and remove the configuration flags for the other.

Step-by-Step Fixes

Depending on how you are executing your command (PowerShell or a specific software tool), follow the appropriate method below to resolve the conflict.

Method 1: Fix PowerShell Session Configurations

If you are using New-PSSession, Enter-PSSession, or Invoke-Command in PowerShell, you have likely combined conflicting parameters.

1. Open your PowerShell script or console.
2. Locate the line of code initiated for the remote connection.
3. Check if you are using both -CertificateThumbprint (or -Authentication Certificate) AND the -Credential parameter together.
4. Choose one option:
   • To use Username/Password: Remove the certificate parameters.

     # Correct Username/Password Approach
     \$Cred = Get-Credential
     New-PSSession -ComputerName "RemotePC" -Credential \$Cred -Authentication Negotiate

   • To use Certificate: Remove the -Credential parameter.

     # Correct Certificate Approach
     New-PSSession -ComputerName "RemotePC" -CertificateThumbprint "1234567890ABCDEF..."

Method 2: Fix Ansible Inventory and Playbooks

If this error occurs while connecting from an Ansible control node to a Windows host, your host variables are conflicting.

1. Open your Ansible inventory file (hosts.yml) or your group variables file.
2. Look for the ansible winrm cert validation or ansible winrm certificate key pem variables.
3. Look for the ansible password and ansible user variables.
4. Choose one option:
   • To use Username/Password: Remove or comment out the certificate variable lines. Ensure ansible winrm transport is set to ntlm, kerberos, or credssp.
   • To use Certificate: Set ansible winrm transport to certificate and remove the ansible password variable from the configuration.

Method 3: Reset WinRM Client Authentication to Defaults

If the issue is caused by corrupted system-wide client settings, resetting the WinRM client configuration can help.

1. Click the Start menu, type cmd, right-click Command Prompt, and select Run as administrator.
2. Run the following command to check your current client configuration:

   winrm get winrm/config/client

3. Run this command to reset the WinRM properties back to default settings:

   winrm reset

4. Restart the WinRM service to apply changes:

   net stop winrm
   net start winrm

Method 4: Fix Third-Party Monitoring Tools (e.g., SolarWinds, PRTG, Nagios)

If a monitoring application is throwing this error while polling a Windows Server:

1. Open the management console of your monitoring tool.
2. Navigate to the asset settings or credential manager for the target Windows machine.
3. Check the connection profile properties.
4. Uncheck any boxes labeled Use Client Certificate or SSL Client Certificate if you have already typed a username and password into the fields.
5. Save the profile and force a re-poll of the node.