Error Description

This error occurs when you try to update or configure the WinRM (Windows Remote Management) certificate mapping store locally on the machine. Microsoft designed certain WinRM configuration changes—specifically relating to certificate mappings (Config/Service/CertificateMapping)—to be executed exclusively via a remote session for security reasons. When Windows detects that you are running these commands from a local Command Prompt or PowerShell session, it blocks the operation and throws this specific error.

Step-by-Step Fixes

You can bypass this restriction by using either of the two methods detailed below.

Method 1: Use Loopback Remote Session (Recommended)

The easiest way to fool the system into thinking you are making the change remotely is to establish a loopback WinRM session to your own machine.

1. Open PowerShell as an Administrator.
2. Run the following command to enable local loopback remote management if it is not already enabled:

   Enable-PSRemoting -Force

3. Start a new remote session targeting your local machine using its IP address or computer name:

   Enter-PSSession -ComputerName "127.0.0.1" -Credential (Get-Credential)

4. Enter your administrator credentials when prompted.
5. Once the prompt changes to indicate you are in a remote session, run your original WinRM command to update the certificate mapping store.
6. Type Exit-PSSession to close the connection when finished.

Method 2: Configure via PowerShell WSMan Provider

Instead of using the standard winrm command-line utility, you can often bypass this specific remote restriction by directly modifying the WSMan configuration path using native PowerShell provider commands.

1. Open PowerShell as an Administrator.
2. Navigate to the WSMan service configuration directory by running:

   cd WSMan:\localhost\Service\

3. View your existing configuration to verify the path:

   Get-ChildItem

4. Create or update your certificate mapping directly using the New-Item or Set-Item cmdlets. For example:

   New-Item -Path .\CertificateMapping -Attributes @{Issuer="<ISSUER THUMBPRINT>"; Subject="<SUBJECT>"; URI="*"} -Force

   (Replace <ISSUER THUMBPRINT> and <SUBJECT> with your actual certificate details).