5.33 (L2) Ensure 'Windows Remote Management (WS-Management) (WinRM)' is set to 'Disabled'

Information

Windows Remote Management (WinRM) service implements the WS-Management protocol for remote management. WS-Management is a standard web services protocol used for remote software and hardware management. The WinRM service listens on the network for WS-Management requests and processes them.
The recommended state for this setting is: Disabled.

Rationale:
Features that enable inbound network connections increase the attack surface. In a high security environment, management of secure workstations should be handled locally.

Solution

To establish the recommended configuration via GP, set the following UI path to: Disabled.
Computer Configuration\Policies\Windows Settings\Security Settings\System Services\Windows Remote Management (WS-Management)

Impact:
The ability to remotely manage the system with WinRM will be lost.
Note: Many remote administration tools, such as System Center Configuration Manager (SCCM), may require the WinRM service to be operational for remote management.

Default Value:
Manual

See Also

https://workbench.cisecurity.org/files/2754

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|9.1, CSCv7|9.2

Plugin: Windows

Control ID: e308d1f498ce4a13b59b768e553c4b243d7055b756531dcca831ee9c7e4dcf2c