How to fix "The WinRM client cannot process the request because the provided security descriptor is invalid."

Description

This error occurs when the Windows Remote Management (WinRM) service fails to parse or apply the Security Descriptor Definition Language (SDDL) string assigned to its configuration or session configurations (like Microsoft.PowerShell). This usually happens due to manual configuration errors, corrupted registry entries, or faulty group policies that attempt to restrict WinRM access but use a malformed SDDL format. Because the security descriptor is invalid, the WinRM service blocks all incoming or outgoing remote connections to protect the system.

Step-by-Step Fixes

Method 1: Reset WinRM Security Configurations to Default

The quickest way to fix an invalid security descriptor is to reset the WinRM default session configurations.

1. Click the Start menu, type cmd.
2. Right-click Command Prompt and select Run as administrator.
3. Type the following command and press Enter to restore default endpoints:

   Enable-PSRemoting -Force

4. If the error prevents PowerShell from executing that command, run this in the standard Command Prompt to rebuild the WinRM listener:

   winrm quickconfig -q

Method 2: Repair the Root SDDL via Registry Editor

If the default configuration commands fail, you can manually remove the corrupted security descriptor from the Windows Registry so WinRM can regenerate it.

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to the following path:

   HKEY LOCAL MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service

3. Look for a binary or string value named RootSDDL.
4. Right-click RootSDDL and select Delete.
5. Navigate to the plugin configuration path to check for specific session corruption:

   HKEY LOCAL MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin

6. Expand the subfolders (like Microsoft.PowerShell) and delete any ConfigSDDL keys that might be corrupted.
7. Close the Registry Editor.
8. Restart your computer or restart the WinRM service by running these commands in an administrative Command Prompt:

   net stop winrm
   net start winrm

Method 3: Fix Malformed SDDL via PowerShell (If Access Allowed)

If you can open a local PowerShell console as an administrator, you can explicitly overwrite the broken security descriptor with a clean, default SDDL string.

1. Open PowerShell as an Administrator.
2. Run the following command to set a universal, standard security descriptor for the WinRM root configuration:

   Set-Item WSMan:\localhost\Service\RootSDDL -Value "O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"

3. Restart the WinRM service to apply changes:

   Restart-Service winrm

Method 4: Check and Revert Group Policy Settings

If this error started happening across multiple machines suddenly, a Group Policy Object (GPO) might be pushing an incorrect SDDL string.

1. Press Win + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service
3. Look for the policy named Disallow WinRM unencrypted traffic or any custom security settings.
4. Ensure no custom, malformed security descriptor strings are pasted into policy fields.
5. If changes are made, open Command Prompt as an administrator and force a policy update:

   gpupdate /force