Detections
Analytics

5.36 Ensure 'Windows Remote Management (WS-Management) (WinRM)' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Windows Remote Management (WinRM) service implements the WS-Management protocol for remote management.

WS-Management is a standard web services protocol used for remote software and hardware management.

The WinRM service listens on the network for WS-Management requests and processes them.

The recommended state for this setting is: 'Disabled'.

Rationale:
Features that enable inbound network connections increase the attack surface.

In a high security environment, management of secure workstations should be handled locally.

Solution

To establish the recommended configuration via GP, set the following UI path to: 'Disabled'.


Computer Configuration\Policies\Windows Settings\Security Settings\System Services\Windows Remote Management (WS-Management)


Impact:
The ability to remotely manage the system with WinRM will be lost.

Note: Many remote administration tools, such as System Center Configuration Manager (SCCM), may require the WinRM service to be operational for remote management.

See Also

https://workbench.cisecurity.org/files/1929

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7

Plugin: Windows

Control ID: a7f3756e8fbfdf7168a2122f93a24dc698d42d68b101dab3710c58cfa4053bbf