Allow remote server management through WinRM
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Vista
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Service Description
This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port. If you enable this policy setting, the WinRM service automatically listens on the network for requests on the HTTP transport over the default HTTP port. To allow WinRM service to receive requests over the network, configure the Windows Firewall policy setting with exceptions for Port 5985 (default port for HTTP). If you disable or do not configure this policy setting, the WinRM service will not respond to requests from a remote computer, regardless of whether or not any WinRM listeners are configured. The service listens on the addresses specified by the IPv4 and IPv6 filters. The IPv4 filter specifies one or more ranges of IPv4 addresses, and the IPv6 filter specifies one or more ranges of IPv6addresses. If specified, the service enumerates the available IP addresses on the computer and uses only addresses that fall within one of the filter ranges. You should use an asterisk (*) to indicate that the service listens on all available IP addresses on the computer. When * is used, other ranges in the filter are ignored. If the filter is left blank, the service does not listen on any addresses. For example, if you want the service to listen only on IPv4 addresses, leave the IPv6 filter empty. Ranges are specified using the syntax IP1-IP2. Multiple ranges are separated using "," (comma) as the delimiter. Example IPv4 filters:\n2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22 Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562
Registry
Software\Policies\Microsoft\Windows\WinRM\Service Value name: AllowAutoConfig
Enabled: AllowAutoConfig = 1
Disabled: AllowAutoConfig = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/RemoteManagement/AllowRemoteServerManagement Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Allow remote server management through WinRM
; State: Enabled
; Supported on: At least Windows Vista
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service]
"AllowAutoConfig"=dword:00000001
"IPv4Filter"=""
"IPv6Filter"=""More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Allow remote server management through WinRM
# State: Enabled
# Supported on: At least Windows Vista
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowAutoConfig' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'IPv4Filter' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'IPv6Filter' -Value '' -Type StringIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/RemoteManagement/AllowRemoteServerManagement
Data type: String
Value:
<enabled/>
<data id="AllowAutoConfig_IPv4Filter" value=""/>
<data id="AllowAutoConfig_IPv6Filter" value=""/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Allow remote server management through WinRM
# State: Enabled
# Supported on: At least Windows Vista
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service' -Name 'AllowAutoConfig' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service' -Name 'IPv4Filter' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service' -Name 'IPv6Filter' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Allow remote server management through WinRM
# State: Enabled
# Supported on: At least Windows Vista
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowAutoConfig' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'IPv4Filter' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'IPv6Filter' -Value '' -Type StringSCCM scripts
# Exported from gporais.com
# Policy: Allow remote server management through WinRM
# State: Enabled
# Supported on: At least Windows Vista
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Allow remote server management through WinRM
# State: Enabled
# Supported on: At least Windows Vista
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service' -Name 'AllowAutoConfig' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service' -Name 'IPv4Filter' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service' -Name 'IPv6Filter' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Allow remote server management through WinRM
# State: Enabled
# Supported on: At least Windows Vista
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowAutoConfig' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'IPv4Filter' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'IPv6Filter' -Value '' -Type StringBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.