How to fix "The WS-Management client cannot process the request. The subscriber machine is not joined to a domain."

Error Description

This error occurs when you attempt to configure or use WS-Management (Web Services-Management / WinRM) for remote management, event forwarding, or subscription handling on a machine that operates within a Workgroup rather than an Active Directory Domain. By default, Windows enforcement policies restrict certain WS-Management and event subscription operations to domain environments for mutual authentication and security purposes. When the local machine (the subscriber) is not part of a domain, the WinRM client blocks the handshake, resulting in the error message: "The WS-Management client cannot process the request. The subscriber machine is not joined to a domain."

Step-by-Step Fix

To resolve this issue, you must configure the Windows Remote Management (WinRM) service to accept non-domain connections by adding the target computers to the TrustedHosts list and modifying the local security policies. Follow these steps on the machine experiencing the error:

Step 1: Open PowerShell as Administrator

1. Click on the Start menu.
2. Type PowerShell in the search bar.
3. Right-click on Windows PowerShell from the results and select Run as administrator.

Step 2: Enable and Configure the WinRM Service

1. In the PowerShell window, type the following command to ensure the WinRM service is running and configured to start automatically:

   Enable-PSRemoting -Force

2. Press Enter. If prompted to make changes, type Y and press Enter.

Step 3: Add Destination Hosts to the TrustedHosts List

Since the machine is not in a domain, you must explicitly tell Windows to trust the remote computers you are connecting to.

1. To trust all computers (recommended for testing or secure private networks), execute:

   Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force

2. Alternatively, if you want to trust only specific computers for better security, replace the asterisk with a comma-separated list of IP addresses or hostnames:

   Set-Item WSMan:\localhost\Client\TrustedHosts -Value "192.168.1.50, RemotePCName" -Force

3. Restart the WinRM service to apply the new configuration changes:

   Restart-Service WinRM

Step 4: Configure Local Account Token Filter Policy (If using Local Admin accounts)

If you are connecting using local administrator accounts rather than domain accounts, Windows User Account Control (UAC) might still block the connection. You need to modify the registry to allow remote administrative operations.

1. Run the following command in your administrative PowerShell window to create the necessary registry key:

   New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "LocalAccountTokenFilterPolicy" -Value 1 -PropertyType DWord -Force

Step 5: Verify the Configuration

1. Check that your TrustedHosts settings were applied correctly by running:

   Get-Item WSMan:\localhost\Client\TrustedHosts

2. Verify that the configuration resolves your issue by re-running your original command or event subscription task.