Detections
Analytics

5.40 Ensure 'Windows Remote Management (WS-Management) (WinRM)' is set to 'Disabled'

Information

Windows Remote Management (WinRM) service implements the WS-Management protocol for remote management. WS-Management is a standard web services protocol used for remote software and hardware management. The WinRM service listens on the network for WS-Management requests and processes them.

The recommended state for this setting is: Disabled.

Features that enable inbound network connections increase the attack surface. In a high security environment, management of secure workstations should be handled locally.

Solution

To establish the recommended configuration, run the following PowerShell command:

Set-Service -Name WinRM -StartupType Disabled

Impact:

The ability to remotely manage the system with WinRM will be lost.

Note: Many remote administration tools, such as System Center Configuration Manager (SCCM), may require the WinRM service to be operational for remote management.

See Also

https://workbench.cisecurity.org/benchmarks/28052

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 7595d0d72d952dbcfd5d003d6fb6622fb3209e1bddcb0b337e1b996686b2f39a