How to Fix Windows Error: "The WinRM service cannot make the configuration change."

Description of the Error

This error typically occurs when you try to configure Windows Remote Management (WinRM) using commands like winrm quickconfig or Enable-PSRemoting.

The full error message usually states: "The WinRM service cannot make the configuration change. The configuration change is blocked because the firewall exception cannot be enabled. This can happen if the network location type for one of the network connections on this computer is set to Public."

Why It Happens

By default, Windows Firewall blocks WinRM traffic on Public networks to protect your system. If even one of your active network adapters (like a virtual adapter or an unused Ethernet port) is categorized as a Public network, Windows will prevent the WinRM service from completing its setup.

Step-by-Step Easy Fixes

You can resolve this issue using either Windows PowerShell or the Windows Settings GUI.

Method 1: Change Network Profile to Private using PowerShell (Recommended)

This is the fastest method because it instantly changes your active network location from Public to Private, allowing WinRM to configure successfully.

1. Open PowerShell as Administrator

   • Click the Start menu.
   • Type powershell.
   • Right-click Windows PowerShell and select Run as administrator.

2. Check your current network connection profiles

   • Type the following command and press Enter:

     Get-NetConnectionProfile

   • Look at the NetworkCategory line for your active connections. If it says Public, it is blocking WinRM.

3. Change the network category to Private

   • Type the following command to change all active profiles to Private and press Enter:

     Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private

   • (Alternative) If you only want to change a specific network, use its interface index number (e.g., Index 4):

     Set-NetConnectionProfile -InterfaceIndex 4 -NetworkCategory Private

4. Run the WinRM configuration again

   • Now that the network is private, run your setup command again:

     winrm quickconfig

   • Or:

     Enable-PSRemoting -Force

Method 2: Change Network Profile via Windows Settings (GUI)

If you prefer using the standard Windows visual interface, follow these steps:

1. Open Network Settings

   • Press the Windows Key + I on your keyboard to open the Settings app.
   • Click on Network & internet from the left-hand sidebar.

2. Select your Active Connection

   • If you are using a cable, click on Ethernet.
   • If you are using wireless internet, click on Wi-Fi and then click on your specific network properties.

3. Change to Private

   • Under the Network profile type section, change the selection from Public network to Private network.

4. Retry WinRM Configuration

   • Open your command line tool and re-run your winrm quickconfig or setup command.

Method 3: Bypass the Firewall Check (Advanced Option)

If you absolutely must keep your network profile set to Public but still need WinRM enabled for local testing, you can tell WinRM to skip the firewall exception check.

1. Open PowerShell as Administrator

   • Right-click the Start menu and choose Terminal (Admin) or PowerShell (Admin).

2. Run the skip-check command

   • Type the following command and press Enter:

     Enable-PSRemoting -SkipNetworkProfileCheck -Force

   • This forces WinRM to enable itself without checking or changing your firewall settings for public networks.