How to fix "The WINRM certificate mapping configuration store has reached an internal limit and cannot create any more entries. Remove some entries and try again."

The Error occurs when the Windows Remote Management (WinRM) configuration store exceeds its maximum capacity for certificate-to-user mappings. This typically happens in environments that rely heavily on Certificate-Based Authentication for WinRM, where old, unused, or duplicate mappings accumulate over time without being purged.

When this limit is reached, WinRM blocks the creation of new client certificate mappings, preventing new users or services from establishing remote connections.

Step-by-Step Fix

To resolve this issue, you must clear out stale or duplicate certificate mappings using the Command Prompt or PowerShell.

Step 1: Open Command Prompt as Administrator

1. Press the Windows Key on your keyboard.
2. Type cmd into the search bar.
3. Right-click on Command Prompt from the search results.
4. Select Run as administrator.

Step 2: View Existing WinRM Certificate Mappings

Before deleting entries, list all current mappings to identify which ones are obsolete or redundant. Run the following command:

winrm enumerate winrm/config/service/certmapping

This command displays a list of all active certificate mappings, including their Issuer, Subject, URI, and UserName.

Step 3: Delete Unused or Duplicate Mappings

To free up space in the internal configuration store, remove specific entries by targetting their unique identifiers (Subject, Issuer, and URI). Execute the delete command using this structure:

winrm delete winrm/config/service/certmapping?Issuer=ISSUER THUMBPRINT+Subject=SUBJECT NAME+URI=TARGET URI

Replace ISSUER THUMBPRINT, SUBJECT NAME, and TARGET URI with the exact values returned from the list in Step 2.

Step 4: Increase the Configuration Store Limit (Optional)

If your environment requires a high volume of concurrent mappings, you can increase the MaxEnvelopeSizeKB setting to give WinRM more operational memory for configuration data. Run this command:

winrm set winrm/config @{MaxEnvelopeSizeKB="8192"}

Step 5: Restart the WinRM Service

Apply all changes by restarting the Windows Remote Management service. Run these two commands in sequence:

net stop winrm
net start winrm

Prevention Best Practices

• Automate Cleanup: Implement a PowerShell script via Task Scheduler to automatically delete expired certificate mappings.
• Use Group Policies: Use Active Directory Group Policy Objects to manage WinRM access globally instead of relying on individual local certificate mappings.