Windows Error Fix: WinRM WS-Policy Compliance Issue

Error Description

This error occurs when a client computer attempts to establish a remote connection via Windows Remote Management (WinRM), but the configuration parameters or authentication protocols requested by the client do not match the capabilities or security policies configured on the destination server.

Specifically, the DeliverTo field in the SOAP request header contains delivery or security options (such as specific encryption requirements, credential types, or message routing) that the receiving WinRM service is not configured to accept or understand. This mismatch commonly happens after system updates, changes to Active Directory Group Policies, or when trying to mix different authentication methods like Kerberos, Basic, and CredSSP without proper matching endpoints.

Step-by-Step Fixes

Method 1: Enable and Configure WinRM Authentication Types

Often, this error happens because the server and client are trying to use different authentication methods. Enabling the necessary authentication types on both machines resolves the conflict.

1. Click the Start menu, type cmd, right-click Command Prompt, and select Run as administrator.
2. Run the following command to check your current WinRM configuration:

   winrm get winrm/config

3. Enable Negotiate authentication (the default standard) on the client and server by executing:

   winrm set winrm/config/client/auth @{Negotiate="true"}
   winrm set winrm/config/service/auth @{Negotiate="true"}

4. If your workflow requires CredSSP or Basic authentication, explicitly enable them using these commands:

   winrm set winrm/config/client/auth @{CredSSP="true"}
   winrm set winrm/config/service/auth @{CredSSP="true"}

5. Restart the WinRM service to apply changes:

   net stop winrm
   net start winrm

Method 2: Configure the TrustedHosts List

If you are connecting to a server outside of your local Active Directory domain, the client must explicitly trust the destination IP address or hostname.

1. Open Command Prompt as an administrator.
2. Run the following command to allow the client to connect to the specific destination IP address or hostname (replace SERVER IP OR NAME with your actual destination):

   winrm set winrm/config/client @{TrustedHosts="SERVER IP OR NAME"}

3. If you are working in a secure, isolated lab environment and want to accept all hosts, you can use a wildcard (not recommended for production environments):

   winrm set winrm/config/client @{TrustedHosts="*"}

4. Verify that the host has been successfully added to the list:

   winrm get winrm/config/client

Method 3: Reset WinRM to Default Configuration

If the configuration has become deeply misaligned or corrupted, resetting the WinRM listeners and service settings back to clean defaults will clear the policy mismatch.

1. Open Command Prompt as an administrator.
2. Run the quick configuration tool to repair the service, open firewall ports, and re-create the default listeners:

   winrm quickconfig

3. Type y (Yes) when prompted to make the requested changes and configure the firewall exceptions automatically.
4. If you are working with PowerShell, you can alternatively run this command inside an elevated PowerShell window to enforce compliance:

   Enable-PSRemoting -Force

Method 4: Modify Local Group Policy for WinRM Client

Windows Group Policy can enforce strict security options that override local WinRM command line configurations. Adjusting these settings ensures the client uses policy options compliance parameters.

1. Press Windows Key + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.
2. Navigate to the following directory path: Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Client
3. Locate the setting named Allow unencrypted traffic and double-click it. Set it to Enabled if your environment does not use HTTPS/SSL, or leave it configured according to your company safety guidelines.
4. Locate the setting named Disallow Digest authentication and set it to Disabled or Not Configured to maximize options.
5. Open Command Prompt as an administrator and force the policy changes to take effect immediately:

   gpupdate /force