How to fix "The WS-Management service cannot process the request because the a header in the request is invalid."

Error Description

This error typically occurs in Windows when executing PowerShell Remoting commands (such as Invoke-Command or Enter-PSSession) or when applications attempt to use the Windows Remote Management (WinRM) service. It indicates that the WS-Management SOAP request packet contains a header that does not comply with the protocol specifications, or the WinRM service configuration on either the client or the host machine has become corrupted, restricted, or misaligned with maximum request size limits.

Step-by-Step Fixes

Follow these steps in order to resolve the issue:

Step 1: Restart the WinRM Service

Sometimes the WS-Management service encounters a temporary glitch handling request headers. Restarting the service refreshes its state.

1. Press the Windows Key, type cmd, right-click on Command Prompt, and select Run as administrator.
2. Type the following command to stop the service: net stop winrm
3. Type the following command to start the service: net start winrm

Step 2: Repair the WinRM Configuration (Quick Config)

Running the quick configuration tool resets standard listeners and enables default firewall exceptions.

1. Open PowerShell as an Administrator (Right-click Start menu -> Terminal (Admin) or PowerShell (Admin)).
2. Type the following command and press Enter: winrm quickconfig
3. If prompted to make changes or enable the firewall exception, type y (Yes) and press Enter.

Step 3: Increase Maximum Envelope Size

If the request payload or header structure is too large (often due to deep active directory group memberships or extensive Kerberos tokens), WinRM will reject the invalid header size. Increasing the envelope size resolves this.

1. Open PowerShell as an Administrator.
2. Run the following command to check the current configuration value: get-item WSMan:\localhost\MaxEnvelopeSizeKB
3. Increase the limit by running this command (setting it to 8192 KB is a stable recommendation): set-item WSMan:\localhost\MaxEnvelopeSizeKB 8192
4. Restart the WinRM service to apply the configuration: Restart-Service winrm

Step 4: Configure Trusted Hosts

If you are connecting to a remote machine that is not part of a domain, the client machine must explicitly trust the destination target header identity.

1. Open PowerShell as an Administrator.
2. To trust all hosts temporarily for testing, run: Set-Item WSMan:\localhost\Client\TrustedHosts -Value * -Force
3. Alternatively, replace the asterisk * with the specific IP address or hostname of the remote machine to maintain security.
4. Restart the WinRM service: Restart-Service winrm

Step 5: Check and Adjust MaxFieldLength and MaxRequestBytes in Registry

If WinRM communication goes through HTTP/HTTPS layers managed by the Windows HTTP protocol stack (Http.sys), large Kerberos security headers might get truncated.

1. Press Windows Key + R, type regedit, and hit Enter to open the Registry Editor.
2. Navigate to the following path: HKEY LOCAL MACHINE\System\CurrentControlSet\Services\HTTP\Parameters
3. Look for MaxFieldLength and MaxRequestBytes in the right pane. If they do not exist, right-click an empty space, choose New > DWORD (32-bit) Value, and name them accordingly.
4. Double-click MaxFieldLength, set the Base to Decimal, and set the Value data to 65534.
5. Double-click MaxRequestBytes, set the Base to Decimal, and set the Value data to 16777216.
6. Reboot your computer for the system-level network configurations to take effect.