Fixing WinRM Error: "The WinRM client received an unknown HTTP status code from the remote WS-Management service"

Error Description

This error occurs when a local Windows Remote Management (WinRM) client attempts to connect to a remote target machine, but the remote web server or WS-Management service returns an unexpected HTTP response code (such as 403 Forbidden, 404 Not Found, or 500 Internal Server Error) instead of the standard WinRM protocol responses. This mismatch typically happens due to misconfigured WinRM listeners, port conflicts with Internet Information Services (IIS), incorrect authentication settings, proxy server interference, or SSL/TLS certificate mismatches when using HTTPS.

Step-by-Step Fixes

Step 1: Verify and Restart the WinRM Service

Ensure that the Windows Remote Management service is actively running on both the local and remote computers.

1. Press Windows Key + R, type services.msc, and press Enter.
2. Scroll down to find Windows Remote Management (WS-Management).
3. Check its status. If it is not running, right-click it and select Start.
4. If it is already running, right-click it and select Restart.
5. Double-click the service, change the Startup type to Automatic, and click OK.

Step 2: Check for Port Conflicts (Especially with IIS)

WinRM uses default ports 5985 (HTTP) and 5986 (HTTPS). If another application (like IIS) is listening on these ports or if WinRM is accidentally bound to port 80/443, it will cause this error.

1. Open PowerShell as an Administrator.
2. Run the following command to see what ports WinRM is listening on:

   winrm enumerate winrm/config/listener

3. Verify that the ports match 5985 or 5986. If you notice a conflict or need to reset the quick configuration, run:

   winrm quickconfig

4. Press Y to accept any configuration changes.

Step 3: Configure Trusted Hosts

If you are connecting to a remote machine outside of an Active Directory domain environment (such as a workgroup), your local machine must trust the remote host.

1. Open PowerShell as an Administrator on your local machine.
2. Run the following command to allow connections to all hosts (or replace * with the specific remote IP address):

   Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force

3. Restart the WinRM service to apply changes:

   Restart-Service winrm

Step 4: Bypass Proxy Server Settings

Sometimes local system proxy settings route internal WinRM traffic to an external proxy server, which fails to recognize the WS-Management traffic and returns an unknown HTTP status code.

1. Open Command Prompt as an Administrator.
2. Check if a proxy is configured by running:

   netsh winhttp show proxy

3. If a proxy is active and routing local traffic, reset it by running:

   netsh winhttp reset proxy

4. Alternatively, ensure your environment variables bypass proxies for local addresses by adding the remote machine's IP to your environment's NO PROXY list.

Step 5: Adjust Authentication Settings

The error can trigger if the client and server do not agree on the authentication method (e.g., Negotiate, Basic, CredSSP).

1. Open PowerShell as an Administrator on both the client and remote machines.
2. Enable standard Negotiate authentication by running:

   Set-Item WSMan:\localhost\Service\Auth\Negotiate -Value \$true
   Set-Item WSMan:\localhost\Client\Auth\Negotiate -Value \$true

3. If your connection strategy requires basic authentication, enable it explicitly:

   Set-Item WSMan:\localhost\Service\Auth\Basic -Value \$true
   Set-Item WSMan:\localhost\Client\Auth\Basic -Value \$true