Windows Remote Management (WS-Management)(WinRM)ID: oval:org.secpod.oval:def:80630 | Date: (C)2022-06-02 (M)2023-12-13 |
Class: COMPLIANCE | Family: windows |
Windows Remote Management (WinRM) service implements the WS-Management protocol for remote management. WS-Management is a standard web services protocol used for remote software and hardware management. The WinRM service listens on the network for WS-Management requests and processes them.
Features that enable inbound network connections increase the attack surface. In a high
security environment, management of secure workstations should be handled locally.
Default: Manual.
Counter Measure:
The recommended state for this setting is Disabled.
Potential Impact:
The ability to remotely manage the system with WinRM will be lost.
Note: Many remote administration tools, such as System Center Configuration Manager (SCCM), may require the WinRM service to be operational for remote management.
Fix:
(1) GPO: Computer Configuration\Windows Settings\Security Settings\System Services\Windows Remote Management (WS-Management)
(2) REG: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinRM!Start
Platform: |
Microsoft Windows 10 |