Windows Error: WinRM Client Authentication Failure

Error Description

This error occurs when the Windows Remote Management (WinRM) client attempts to establish a remote connection using an authentication method that requires full user credentials, but the system configuration or command execution fails to provide both the username and password. This frequently happens during remote PowerShell sessions, automated scripting, or server management tasks. Even if you believe you passed the credentials, the underlying WinRM layer rejects the request because it sees an empty or partial credential object, or the current authentication policy restricts passing those credentials to a remote target.

Step-by-Step Fixes

Fix 1: Explicitly Pass Credentials in PowerShell

If you are running a script or a command, do not rely on your current logged-in session credentials automatically passing through without proper parameters.

1. Open PowerShell as an Administrator.
2. Store your credentials in a variable by running: $cred = Get-Credential
3. Enter your target username (e.g., Domain\Username or ComputerName\Username) and password in the prompt.
4. Run your remote command while explicitly attaching the credential variable: Invoke-Command -ComputerName "TARGET COMPUTER" -ScriptBlock { Get-Process } -Credential $cred

Fix 2: Enable and Configure WinRM Client Trusted Hosts

If you are connecting to a workgroup computer or a server outside your local Active Directory domain, the client machine will refuse to send credentials unless the target is explicitly trusted.

1. Right-click the Start button and select Terminal (Admin) or PowerShell (Admin).
2. View your current trusted hosts list by executing: Get-Item WSMan:\localhost\Client\TrustedHosts
3. Add your specific remote computer to the trusted list: Set-Item WSMan:\localhost\Client\TrustedHosts -Value "TARGET COMPUTER IP OR NAME" -Force (Alternatively, use `to trust all computers, though this is less secure:Set-Item WSMan:\localhost\Client\TrustedHosts -Value "" -Force`)
4. Restart the WinRM service to apply changes: Restart-Service WinRM

Fix 3: Enable Basic Authentication in WinRM Settings

If your script or application relies on basic authentication rather than Kerberos, both the client and server must have basic authentication explicitly enabled.

1. Open PowerShell (Admin) on your local machine.
2. Check if basic authentication is enabled for the client: Get-Item WSMan:\localhost\Client\Auth\Basic
3. If it is set to false, enable it by running: Set-Item WSMan:\localhost\Client\Auth\Basic -Value $true
4. Connect to your remote server and run the corresponding command to ensure the server allows it: Set-Item WSMan:\localhost\Service\Auth\Basic -Value $true
5. Restart the service: Restart-Service WinRM

Fix 4: Modify LocalAccountTokenFilterPolicy in Registry

When connecting to a remote machine using a local administrator account instead of a domain administrator account, Windows User Account Control (UAC) strips administrative privileges upon remote connection. You must disable this filtering on the target machine.

1. Log into the Target Remote Machine.
2. Press Windows Key + R, type regedit, and press Enter to open the Registry Editor.
3. Navigate to the following path: HKEY LOCAL MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
4. Right-click on the blank space in the right pane, select New -> DWORD (32-bit) Value.
5. Name the new value: LocalAccountTokenFilterPolicy
6. Double-click LocalAccountTokenFilterPolicy and change its Value data to 1.
7. Click OK and restart the remote computer for changes to take effect.