How to fix "The WinRM client cannot process the request. The resource URI for an enumeration operation with WQL filter must not contain keys and the class name must be '*' (star)."

According to the WS-Management standard implemented by WinRM, when you perform an enumeration with a WQL query filter, the Resource URI must target the base class framework broadly rather than a specific instance or a specific class name with specific keys. WinRM strictly requires that for WQL filter operations, the Resource URI must use an asterisk (*) as a wildcard for the class name and must not contain any specific instance keys (like specific service names, IDs, or handles). If your script, command, or management software constructs a URI that explicitly names a class or specifies instance selectors while simultaneously passing a WQL Filter, the WinRM client blocks the request and throws this error.

Step-by-Step Fixes

Depending on whether you are running a manual command via winrm, executing a PowerShell cmdlet, or writing a custom script, use one of the following solutions to resolve the issue.

Fix 1: Correcting the Command Syntax in winrm Utility

If you are using the command-line utility winrm.cmd to enumerate resources, ensure your -filter switch is paired with a Resource URI that ends with an asterisk (*) and contains no keys.

1. Open Command Prompt or PowerShell as an Administrator.
2. Review your original command. It likely looks incorrect like this: winrm enumerate wmicimv2/Win32 Service?Name=wuauserv -filter:"Select * from Win32 Service Where State='Running'"
3. Change the Resource URI portion to use the asterisk (*) wildcard and remove the key selector (?Name=wuauserv). Modify your command to match this structure:

   winrm enumerate wmicimv2/* -filter:"Select * from Win32 Service Where State='Running'"

4. Press Enter to run the corrected command.

Fix 2: Adjusting PowerShell Cmdlets (Get-WSManInstance / Enumerate)

If you are using native PowerShell WSMan cmdlets, you must ensure the -ResourceURI parameter points to the schema wildcard instead of a specific CIM class or instance key.

1. Open PowerShell.
2. If your failing code looks like this:

   Get-WSManInstance -ResourceURI "wmicimv2/Win32 Process" -Filter "Select * From Win32 Process Where Name='notepad.exe'"

3. Update the -ResourceURI argument to end with /* so the WQL engine can process the class filtering internally:

   Get-WSManInstance -ResourceURI "wmicimv2/*" -Filter "Select * From Win32 Process Where Name='notepad.exe'"

4. Execute the updated script.

Fix 3: Using Alternative PowerShell Cmdlets (Recommended)

If your goal is simply to query WMI/CIM data remotely over the WinRM protocol, it is much easier and less error-prone to use CIM cmdlets instead of raw WSMan block commands. CIM cmdlets automatically handle the URI formatting behind the scenes.

1. Open PowerShell.
2. Replace your complex WSMan enumeration command with the Get-CimInstance cmdlet, which runs over WinRM by default:

   Get-CimInstance -ClassName Win32 Service -Filter "State='Running'" -ComputerName "RemoteComputerName"

3. If you explicitly need to use a full WQL query, use the -Query parameter instead:

   Get-CimInstance -Query "Select * from Win32 Service where State='Running'" -ComputerName "RemoteComputerName"

4. Run the command to fetch the data without triggering WinRM syntax restrictions.