Windows Error Fix: WS-Management Service Access Denied

The error "The WS-Management service cannot process the request. The WMI service returned an 'access denied' error" typically occurs when WinRM (Windows Remote Management) tries to interact with WMI (Windows Management Instrumentation) but lacks the required permissions. This happens due to misconfigured security descriptors, incorrect user account controls, or restricted namespace permissions.

Here is the complete step-by-step guide to resolve this issue.

Step 1: Run PowerShell as Administrator to Enable WinRM

Sometimes the WinRM service is not properly configured to accept local or remote requests.

1. Press the Windows Key, type powershell.
2. Right-click on Windows PowerShell and select Run as administrator.
3. Type the following command and press Enter:

   winrm quickconfig

4. If prompted to make changes, type y and press Enter.

Step 2: Configure WMI Control Permissions

The user or service account must have explicit permissions to access the WMI Root namespace.

1. Press Win + R to open the Run dialog box.
2. Type wmimgmt.msc and press Enter.
3. Right-click on WMI Control (Local) in the left pane and select Properties.
4. Go to the Security tab.
5. Expand the Root folder, select the CIMV2 namespace, and click the Security button at the bottom.
6. Look for your user account or the group you are using (e.g., Administrators or Remote Management Users). If it is not there, click Add to add the user/group.
7. Click on the user/group and look at the permissions panel below.
8. Check the Allow box for the following permissions:
   • Execute Methods
   • Enable Account
   • Remote Enable
   • Read Security
9. Click Advanced.
10. Select the user and click Edit. Ensure that the Applies to dropdown is set to This namespace and subnamespaces.
11. Click OK, then Apply, and close all WMI property windows.

Step 3: Modify User Account Control (UAC) Registry Settings

If you are logging in with a local administrator account remotely, Windows UAC might strip your administrative tokens, resulting in an "access denied" error.

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to the following path: HKEY LOCAL MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
3. Right-click on an empty space in the right pane, select New, and then click DWORD (32-bit) Value.
4. Name the new value: LocalAccountTokenFilterPolicy
5. Double-click LocalAccountTokenFilterPolicy and change its Value data to 1.
6. Base should remain Hexadecimal.
7. Click OK and close the Registry Editor.

Step 4: Add User to Remote Management Users Group

Your account must belong to the correct security groups to utilize WinRM services without triggering security blocks.

1. Press Win + R, type lusrmgr.msc, and press Enter (Note: If using Windows Home, use the command line method below instead).
2. Click on Groups in the left folder.
3. Double-click on Remote Management Users.
4. Click Add, type your username, and click Check Names.
5. Click OK, then Apply.

Alternative Command Line Method for all Windows versions:

1. Open Command Prompt as Administrator.
2. Run the following command (replace YourUsername with your actual Windows username):

   net localgroup "Remote Management Users" YourUsername /add

Step 5: Restart the WinRM and WMI Services

Apply all modifications by restarting both services.

1. Open Command Prompt as Administrator or use the open PowerShell window.
2. Stop and start the WMI service by running:

   net stop winmgmt /y
   net start winmgmt

3. Restart the WinRM service by running:

   net stop winrm
   net start winrm