Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Windows Server 2012 (and Server 2008, but it is next priority) to monitor it using txwinrm. txwinrm library internally is using WinRS protocol. I have to monitor it using least privileged user, but don't know how to configure access for him.

All I managed to do - is to configure remote Powershell session for my user, but it's look like that winrs and powershell sessions have different security descriptors:

Invoke-Command -ComputerName -Credential (credential Administrator $pwd) -ScriptBlock { 2 + 2}
# gives 4
Invoke-Command -ComputerName -Credential (credential lpu1 $pwd) -ScriptBlock { 2 + 2}
# gives 4
winrs -r: -u:Administrator -p:$pwd 'powershell -command "2+2"'
# gives 4
winrs -r: -u:lpu1 -p:$pwd 'powershell -command "2+2"'
# Gives Winrs error: Access is denied.

Configuration for my user is following:

(Get-Item WSMan:\localhost\Service\RootSDDL).value
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1141)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)
(Get-PSSessionConfiguration -name Microsoft.Powershell).SecurityDescriptorSddl
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1149)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)

(In each security descriptor my user is given general access to protected object).

So what security descriptor should I set to make my winrs query work for non-admin user?

UPD: Recently I found that that I could retrieve information about winrm shells:

  winrm enumerate shell
    ShellId = 3793B153-CCCF-4500-99FB-8534074E1738
    ResourceUri =

And I found no such resource URI in WSMan:\localhost\Plugin directory. :( Documentation states:

The resource URI can be used to retrieve plug-in configuration that is specific to the shell instance.

But how to retrieve that plugin configuration and how to change it?

share|improve this question
Have you seen this – MichelZ Apr 24 '14 at 10:34
@MichelZ Yes, I have. – Bunyk Apr 24 '14 at 10:37

Can you add the User using:

winrm configSDDL


share|improve this answer
Alas, no, it says: Error number: -2144108544 0x80338000 The WS-Management service cannot process the request. The service cannot find the resource identified by the resource URI and selectors. Which is strange because Administrator have acces to SOME resource, so that resource should exist. – Bunyk Apr 24 '14 at 12:23
up vote 1 down vote accepted

What works is

winrm configSDDL default

And then allowing read and execute rights. But strange thing, that settings there are the same as in WSMan:\localhost\Service\RootSDDL. It could be because of winrm configSDDL reloads some cache or something, I dunno...

share|improve this answer

you have to add users on the winrm server to the group "Remote Management Users"

It's that simple.

share|improve this answer
Did winrs -r:$host -u:lpu1 -p:$pwd 'powershell -command "2+2"' works for you? Also, this group exists only on Windows Server 2012 (so let's hope that Windows server 2008 and lower will become legacy soon). – Bunyk Nov 20 '14 at 15:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.