Fixing WinRM HTTP 400 Bad Request Error

The WinRM (Windows Remote Management) client throws an HTTP 400 Bad Request error when it attempts to establish a remote connection, but the target server rejects the formatting, size, or headers of the incoming request. Because the remote service does not provide additional details, this error typically stems from local configuration mismatches, corrupted WinRM listeners, SPN (Service Principal Name) issues, or oversized Kerberos authentication tokens.

Here is a step-by-step guide to diagnose and resolve this issue.

Step 1: Run the WinRM Quick Config Tool

The quickest way to fix corrupted listeners or basic service configuration issues is to let Windows automatically repair the WinRM setup.

1. Click the Start menu, type cmd, right-click Command Prompt, and select Run as administrator.
2. Type the following command and press Enter:

   winrm quickconfig

3. If prompted to make changes or configure the firewall exceptions, type y and press Enter.

Step 2: Clear the WinRM Client WinRM TrustedHosts List

An improperly configured TrustedHosts list can cause malformed request headers. Resetting or correctly configuring this list can resolve the communication breakdown.

1. Open Command Prompt as an administrator.
2. To allow communication with any host temporarily (for testing), run:

   winrm set winrm/config/client @{TrustedHosts="*"}

3. Alternatively, if you want to restrict it to your specific target server, replace the asterisk with your target server IP or hostname:

   winrm set winrm/config/client @{TrustedHosts="TARGET SERVER NAME"}

Step 3: Recreate the WinRM HTTP/HTTPS Listeners

If the default listeners on the remote machine are corrupted or bound to conflicting ports, deleting and recreating them fixes the underlying web service routing.

1. Open Command Prompt as an administrator on the target machine.
2. Check existing listeners by running:

   winrm enumerate winrm/config/listener

3. Delete the broken HTTP listener:

   winrm delete winrm/config/listener?Address=*+Transport=HTTP

4. Create a clean HTTP listener:

   winrm create winrm/config/listener?Address=*+Transport=HTTP

5. Restart the WinRM service to apply changes:

   net stop winrm && net start winrm

Step 4: Adjust MaxTokenSize for Kerberos Authentication

If you are connecting via a domain environment and your user account belongs to many Active Directory groups, your Kerberos authentication token might be too large. This causes the WinRM HTTP server to reject the packet as a "Bad Request".

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to the following path: HKEY LOCAL MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters (Note: If the Parameters key does not exist, right-click Kerberos, select New > Key, and name it Parameters).
3. Right-click the Parameters key, select New > DWORD (32-bit) Value.
4. Name the new value MaxTokenSize.
5. Double-click MaxTokenSize, set the Base to Decimal, change the Value data to 65535, and click OK.
6. Reboot your computer to apply the registry changes.

Step 5: Increase the Maximum Envelope Size

Sometimes the data structure payload transmitted via WinRM exceeds the default allowed configuration size, resulting in an immediate HTTP 400 error.

1. Open Command Prompt as an administrator.
2. Run the following command to increase the maximum envelope size to 1500 KB:

   winrm set winrm/config @{MaxEnvelopeSizekb="1500"}

3. Test your remote connection again to see if the payload restriction was causing the issue.