Windows Error Fix: WinRM Encrypted Message Body Invalid Format

Description

This error occurs when a Windows Remote Management (WinRM) client receives an encrypted message that it cannot decrypt. It signifies a mismatch in encryption or authentication configurations between the local client and the remote host. The most common causes include conflicting Kerberos authentication configurations, SPN (Service Principal Name) mismatches, or system time differences between the machines which break the Kerberos ticket validation process.

Step-by-Step Fixes

Perform the following solutions in order until the issue is resolved.

Solution 1: Sync System Time

Kerberos authentication requires the system times on the client and remote host to be synchronized within 5 minutes of each other.

1. Click the Start menu and type cmd.
2. Right-click Command Prompt and select Run as administrator.
3. Type the following command to synchronize time with the domain or network time server:

   w32tm /resync

4. Verify both machines show the exact same current time.

Solution 2: Change Authentication to Basic (Testing Only)

Switching temporarily to Basic authentication bypasses Kerberos encryption issues to determine if Kerberos is the root cause.

1. Open an elevated Command Prompt (Run as administrator) on both the client and remote machine.
2. Run this command on both machines to allow basic authentication:

   winrm set winrm/config/client @{AllowUnencrypted="true"}
   winrm set winrm/config/client/auth @{Basic="true"}
   winrm set winrm/config/service/auth @{Basic="true"}

3. Test your connection. If it works, the issue resides within your Active Directory Kerberos settings or SPNs.

Solution 3: Reset the WinRM Configuration

Corrupted listener configurations can cause encryption mismatches. Resetting the service fixes these structural errors.

1. Open an elevated Command Prompt on the remote server.
2. Run the following command to completely wipe and recreate the default WinRM configuration:

   winrm quickconfig -q

3. Restart the WinRM service to apply the fresh settings:

   net stop winrm && net start winrm

Solution 4: Fix SPN (Service Principal Name) Mismatches

If the remote server has duplicate or missing SPNs, Kerberos cannot encrypt the payload correctly.

1. Open an elevated Command Prompt on a domain controller or a machine with Active Directory tools.
2. Check for duplicate SPNs using the following command (replace ServerName with your target server's name):

   setspn -X

3. If duplicates are found for your WinRM service, delete the invalid duplicate entries using:

   setspn -D WSMAN/ServerName ServerName

4. Re-register the correct SPN using:

   setspn -A WSMAN/ServerName ServerName