How to fix "The Windows Remote Management (WinRM) service cannot be configured for remote access because Group Policy does not allow local firewall changes. Check the Group Policy settings to allow local firewall exceptions and add WinRM to the firewall exceptions."

This error occurs when you try to enable or configure Windows Remote Management (WinRM)—typically using the winrm quickconfig or Enable-PSRemoting commands—but a Local or Domain Group Policy (GPO) is actively blocking the system from modifying the local Windows Firewall rules. To allow WinRM to function, you must configure Group Policy to permit these local firewall exceptions.

Here is the step-by-step guide to fix this error using the Local Group Policy Editor or Domain GPO.

Step 1: Open the Group Policy Editor

1. Press the Windows Key + R on your keyboard to open the Run dialog box.
2. Type gpedit.msc into the box and press Enter. (Note: If you are managing this across a domain, open the Group Policy Management Console (gpmc.msc) on your domain controller instead and edit the relevant GPO applied to the target machine).

Step 2: Navigate to Firewall Settings

In the left pane of the Group Policy Editor, navigate through the folder hierarchy using the following path:

1. Expand Computer Configuration
2. Expand Administrative Templates
3. Expand Network
4. Expand Network Connections
5. Expand Windows Defender Firewall (or Windows Firewall depending on your Windows version)
6. Click on Domain Profile (If your computer is on a domain, or repeat these steps for the Standard Profile / Private Profile if it is a standalone workgroup machine).

Step 3: Enable Local Firewall Rules Exceptions

1. Look at the right-hand pane and locate the setting named Windows Defender Firewall: Allow local program exceptions (or Windows Firewall: Allow local program exceptions).
2. Double-click on this policy setting to open its properties window.
3. Change the selection from Not Configured or Disabled to Enabled.
4. Click Apply and then click OK.

Step 4: Enable Local Port Rules Exceptions (Optional but Recommended)

1. In the same policy folder, find the setting named Windows Defender Firewall: Allow local port exceptions (or Windows Firewall: Allow local port exceptions).
2. Double-click on it.
3. Select Enabled.
4. Click Apply and then click OK.

Step 5: Force Group Policy Update

For the changes to take effect immediately without restarting your computer:

1. Right-click the Windows Start menu button and select Command Prompt (Admin) or Windows PowerShell (Admin).
2. Type the following command and press Enter:

   gpupdate /force

3. Wait for the policy update to complete successfully.

Step 6: Run the WinRM Configuration Again

Now that the firewall restrictions are lifted, you can successfully configure WinRM.

1. In your administrative Command Prompt or PowerShell window, type:

   winrm quickconfig

   (Or Enable-PSRemoting -Force if you are working in PowerShell).

2. Press Enter and type y (Yes) to accept any prompts. The process should now complete without the firewall error.