Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently i have a AD/Kerberos Configured on one EC2 instance(Windows 2008 R2) and created couple of users. Each of the users has administrator privileges. When We login as a non-domain Administrator, i can successfully execute the winrm commands. But when i login as the domain User (who has administrator privileges), i cannot run the winrm commands:

C:\Users\domain-username>winrm get winrm/config/service/auth
    Message = Access is denied.

Error number:  -2147024891 0x80070005
Access is denied.

I check the Group Policy Editor for WinRM did not find anything relevant. I am not sure what i am missing.

share|improve this question
Is SysInternal's "ShellRunAs" tool an acceptable (if hacky) workaround? Supply it the program and an account with the access you need (like a domain admin service account) and you'll be able to execute it under a user's context, whether they have admin rights or not. – HopelessN00b Jul 13 '12 at 20:57

First thing that pops in my head: is cmd elevated? It would be by default on local Administrator account, not so with domain accounts that belong to local Administrators group. Your current prompt (c:\users...) kind of suggests this might be the reason for access rights issues (elevated cmd starts in c:\windows\system32 by default).

I've tested both elevated and non-elevated and get same results as you do with "normal" and expected results with "elevated" one.

share|improve this answer
Thanks for responding. I tried using the WinRM SOAP APIs as well and faced the same issue. Thats the primary usecase actually. So elevating cmd won't help my cause :) – Cheezo Jul 11 '12 at 14:55

You have to add the user to the group "Remote Management Users" on the WinRM server.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.