This error typically signifies that the WinRM service is unable to validate the user credentials against the provided certificate. The root cause usually involves one of the following issues:

• Mismatched Principal Name: The Subject or Subject Alternative Name (SAN) in the certificate does not match the active directory user account or local account you are mapping.
• Untrusted Root Certificate: The certificate authority (CA) that issued the user certificate is not trusted by the local machine or the domain controller.
• Missing Client Authentication Extended Key Usage (EKU): The certificate lacks the specific digital signature purpose required to verify user identities for remote management.
• Account Permissions: The user account lacks the required permissions to log on remotely or map certificates.

Step-by-Step Fixes

Follow these sequential methods to resolve the issue.

Method 1: Verify and Re-import the Root Certificate Authority (CA)

WinRM requires a complete trust chain to verify user credentials. If the root certificate is missing from the Trusted Root store, authentication fails.

1. Press Windows Key + R, type certlm.msc, and press Enter to open the Local Computer Certificate Manager.
2. Navigate to Trusted Root Certification Authorities > Certificates.
3. Check if the CA certificate that issued your WinRM certificate is listed.
4. If it is missing, right-click Certificates, select All Tasks, and click Import.
5. Click Next, browse to your CA root certificate file, and complete the wizard to place it into the Trusted Root Certification Authorities store.

Method 2: Check the Certificate EKU Fields

The certificate used for mapping must explicitly support client authentication.

1. Press Windows Key + R, type certmgr.msc, and press Enter to open the Current User Certificate Manager.
2. Locate the specific certificate you are trying to use for the WinRM mapping.
3. Double-click the certificate and navigate to the Details tab.
4. Scroll down and click on the Enhanced Key Usage (EKU) field.
5. Ensure that Client Authentication (1.3.6.1.5.5.7.3.2) is explicitly listed in the description box. If it is missing, you must request a new certificate with this extension enabled.

Method 3: Configure UAC Remote Restrictions for Local Accounts

If you are mapping a local administrator account rather than a domain account, Windows User Account Control (UAC) may block the credential verification over remote loops.

1. Press Windows Key + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to the following registry path: HKEY LOCAL MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
3. Right-click on an empty space in the right pane, select New, and then click DWORD (32-bit) Value.
4. Name the new value exactly: LocalAccountTokenFilterPolicy
5. Double-click LocalAccountTokenFilterPolicy and change the Value data from 0 to 1.
6. Click OK and restart your computer to apply the policy changes.

Method 4: Correct the WinRM Mapping Command Syntax

Errors often occur because of typos in the Subject, Issuer, or Thumbprint properties during the PowerShell mapping command configuration.

1. Right-click the Start Menu and select Terminal (Admin) or PowerShell (Admin).
2. Extract the correct Issuer thumbprint and Subject information directly from your certificate using this command:

   Get-ChildItem Cert:\LocalMachine\My

3. Run the mapping command using explicit variables to avoid formatting issues. Replace the placeholders with your actual values:

   New-Item -Path WSMan:\localhost\Service\Cardmgmt\CertMapping -CountInfo @{Subject="CN=YourUserName";Issuer="YourIssuerThumbprint";UserName="YourDomain\YourUserName";Password="YourPassword"}

4. If you prefer to map without hardcoding the password, ensure your active command explicitly specifies the URI using the -Target parameter matching the exact Subject string found in Step 2.

Method 5: Restart the WinRM Service

After making certificate and registry adjustments, flush the active configuration by restarting the management service.

1. Open PowerShell (Admin).
2. Execute the following command to restart the service:

   Restart-Service WinRM

3. Verify that the service is running properly by checking its status:

   Get-Service WinRM