--- title: How to enable WinRM with GPO description: How to enable WinRM with GPO --- [Skip to content](https://support.block64.com/how-to-enable-winrm#main-content) [Customer Portal](https://customerportal.block64.com/tickets-view?hsLang=en) [![Logo - dark](https://support.block64.com/hs-fs/hubfs/Logo%20-%20dark.png?width=350&height=86&name=Logo%20-%20dark.png)](https://support.block64.com/?hsLang=en) - [Home](https://support.block64.com/) - [Insights Portal](https://insights.block64.com/login) - Platform Show submenu for Platform - [Block 64](https://www.block64.com/) - [Why Block 64?](https://www.block64.com/#:~:text=What%20makes%2CBlock%2064%20different) - Solutions Show submenu for Solutions - [Unified Visibility](https://www.block64.com/solutions/unified-visibility) - [Cost Optimization](https://www.block64.com/solutions/cost-optimization) - [Proactive Security](https://www.block64.com/solutions/proactive-security) - [Compliance](https://www.block64.com/solutions/continuous-compliance) - Learn Show submenu for Learn - [Quick Start Guides](https://support.block64.com/getting-started) - [Integrations](https://support.block64.com/documentation#integrations) - [Blog](https://www.block64.com/blog) - Support Show submenu for Support - [Trust Center](https://trust.block64.com/) - [Service Health](https://status.block64.com/) - [Partners](https://www.block64.com/partners) - [Contact Us](https://www.block64.com/contact) - [Pricing](https://www.block64.com/pricing) - [Get Started Free](https://www.block64.com/free-trial) Open main navigation Close main navigation - [Home](https://support.block64.com/) - [Insights Portal](https://insights.block64.com/login) - Platform Show submenu for Platform - [Block 64](https://www.block64.com/) - [Why Block 64?](https://www.block64.com/#:~:text=What%20makes%2CBlock%2064%20different) - Solutions Show submenu for Solutions - [Unified Visibility](https://www.block64.com/solutions/unified-visibility) - [Cost Optimization](https://www.block64.com/solutions/cost-optimization) - [Proactive Security](https://www.block64.com/solutions/proactive-security) - [Compliance](https://www.block64.com/solutions/continuous-compliance) - Learn Show submenu for Learn - [Quick Start Guides](https://support.block64.com/getting-started) - [Integrations](https://support.block64.com/documentation#integrations) - [Blog](https://www.block64.com/blog) - Support Show submenu for Support - [Trust Center](https://trust.block64.com/) - [Service Health](https://status.block64.com/) - [Partners](https://www.block64.com/partners) - [Contact Us](https://www.block64.com/contact) - [Pricing](https://www.block64.com/pricing) - [Get Started Free](https://www.block64.com/free-trial) - - [Customer Portal](https://customerportal.block64.com/tickets-view) - [Submit a Support Request](https://support.block64.com/kb-tickets/new) [Submit a Support Request](https://support.block64.com/kb-tickets/new?hsLang=en) How can we assist you today? - There are no suggestions because the search field is empty. 1. [Block 64 Support Center](https://support.block64.com/?hsLang=en) 2. [Documentation](https://support.block64.com/documentation?hsLang=en) 3. [Discovery: General Knowledge](https://support.block64.com/documentation?hsLang=en#discovery-general-knowledge) # How to enable WinRM with GPO ## How to Enable Windows Remote Management (WinRM) for Block 64 Discovery **Purpose:** Enable the Windows Remote Management (WinRM) protocol on endpoints so that the Block 64 Discovery Appliance/ Inventory process can perform full endpoint inventory via WinRM. **Scope:** Applies to domain-joined Windows machines (Windows 10/11, Windows Server 2016/2019/2022). **Prerequisites:** - Endpoints must be reachable on the network, DNS resolution working. - Required firewall ports open: TCP 5985 (HTTP) and/or TCP 5986 (HTTPS). - You must have rights to create or edit GPOs in the target OU, or local admin rights if doing manual. - Ensure that the WinRM service exists (it is installed by default on modern Windows OSes). --- ### Enable WinRM via Group Policy (recommended for domainwide rollout) - On your domain controller, open **Group Policy Management**. - Create a new GPO (e.g., “Block 64 – WinRM Enablement”) and link it to the OU containing the target machines. ![](https://support.block64.com/hs-fs/hubfs/Knowledge%20Base%20Import/14527871894935.jpg?width=644&height=379&name=14527871894935.jpg) - Edit the GPO: - Navigate to **Computer Configuration → Policies → Administrative Templates → Windows Components → Windows Remote Management (WinRM) → WinRM Service**. ![](https://support.block64.com/hs-fs/hubfs/Knowledge%20Base%20Import/14527868079255.jpg?width=644&height=431&name=14527868079255.jpg)  - Double-click **Allow remote server management through WinRM** → set to **Enabled.** Under IPv4 / IPv6 filter, enter the IP of the Appliance (or the server hosting the Discovery App). Alternatively, you may use `*` to allow all addresses (less secure). For example, the policy would look like this: - **IPv4 filter:** *IP address of the Appliance, or use `*`* - **IPv6 filter:** *(leave empty if you do not use IPv6, or use `*` )* **![](https://support.block64.com/hs-fs/hubfs/Knowledge%20Base%20Import/14527876689943.jpg?width=670&height=450&name=14527876689943.jpg)** - Still in the GPO, now start the service: - Navigate to **Computer Configuration → Preferences → Control Panel Settings → Services**. Right-click → New → Service. ![](https://support.block64.com/hs-fs/hubfs/Knowledge%20Base%20Import/14527916353943.jpg?width=670&height=449&name=14527916353943.jpg) - Then, set the new service with the following parameters: - Service name: `WinRM` - Startup type: **Automatic** (or **Automatic (Delayed Start)**) - Action: **Start the service** ![](https://support.block64.com/hs-fs/hubfs/Knowledge%20Base%20Import/14527979198359.jpg?width=670&height=448&name=14527979198359.jpg) - Firewall inbound rule: - Navigate to **Computer Configuration → Policies → Windows Settings → Security Settings → Windows Defender Firewall with Advanced Security → Inbound Rules**. - Right-click **Inbound Rules** → New Rule → ![](https://support.block64.com/hs-fs/hubfs/Knowledge%20Base%20Import/14527970764055.jpg?width=670&height=450&name=14527970764055.jpg) - **Select** Predefined → Windows Remote Management. → Next. ![](https://support.block64.com/hubfs/Knowledge%20Base%20Import/14527972639511.jpg) - Then uncheck the **Public** profile (so only Domain and Private are allowed) → Next. **![](https://support.block64.com/hubfs/Knowledge%20Base%20Import/14527984972311.jpg)** - Ensure **Allow the connection** is selected → Finish **![](https://support.block64.com/hs-fs/hubfs/Knowledge%20Base%20Import/14527975487511.jpg?width=670&height=449&name=14527975487511.jpg)** - That's it. Ensure the policy is linked and scopes correctly; wait for GPO propagation or force it with `gpupdate /force` on a test machine. - (Optional) Verification: On a target machine run in an elevated PowerShell or Command Prompt: ``` Test-WSMan -ComputerName localhostwinrm enumerate winrm/config/listenerGet-Service -Name WinR ``` You should see a listener configured (e.g., `Transport = HTTP`, `Address = *`) and the service in "Running" state. --- ### Enable WinRM Manually on a Single Endpoint This option is useful when you have just a few machines to enable, or you cannot apply a GPO yet. 1. Log into the endpoint as local administrator (or domain admin) and open Command Prompt (Admin) or PowerShell (Admin). 2. Run: winrm quickconfig The command will prompt: “Make these changes \[y/n\]?”. Type `y` and enter. This will start the WinRM service, set startup type to automatic, create a listener, and add a firewall exception for the current user profile. 3. (Optional, more advanced) If you want to enable HTTPS listener: winrm quickconfig -transport:https Note: requires SSL certificate installed on the machine and port 5986 open. 4. Verify as in step 7 of Option 1. 5. If remote machines are in a workgroup rather than domain, you may need to adjust `TrustedHosts` settings: winrm set winrm/config/client @{TrustedHosts="\"} --- #### Troubleshooting / Verification Checklist - Is the WinRM service running? Get-Service -Name WinRM - Are there listeners configured? winrm enumerate winrm/config/listener - Is firewall blocking ports 5985/5986? Use `Test-NetConnection` or `telnet 5985`. - If remote connection fails: check that correct profiles (Domain/Private) are allowed in firewall inbound rules, Public is disabled unless intentionally opened. - For domain environments: ensure Kerberos authentication, no time skew, DNS resolution works. - For workgroup/HTTPS scenarios: ensure you have valid certificate (no self-signed except for test), listener transport HTTPS configured. --- By following either the GPO method (for large scale) or the manual method (for individual machines), you’ll enable WinRM effectively for your endpoints to be inventoried by the Block 64 Tools. Ensure firewall and security settings are correct, verify connections, and restrict access wherever possible for best practice. - [Getting Started](https://support.block64.com/getting-started?hsLang=en#main-content) - [Free Trial Onboarding](https://support.block64.com/getting-started?hsLang=en#free-trial-onboarding) - [Start Your Subscription](https://support.block64.com/getting-started?hsLang=en#start-your-subscription) - [Discovery Application Installation](https://support.block64.com/getting-started?hsLang=en#discovery-application-installation) - [Discovery Appliance Setup](https://support.block64.com/getting-started?hsLang=en#discovery-appliance-setup) - [Discovery Agent Deployment](https://support.block64.com/getting-started?hsLang=en#discovery-agent-deployment) - [Insights Reports](https://support.block64.com/insights-reports?hsLang=en#main-content) - [IT Asset Management](https://support.block64.com/insights-reports?hsLang=en#it-asset-management) - [Security](https://support.block64.com/insights-reports?hsLang=en#security) - [Cloud & Infrastructure](https://support.block64.com/insights-reports?hsLang=en#cloud-infrastructure) - [The Combine: User Guide](https://support.block64.com/insights-reports?hsLang=en#the-combine-user-guide) - [Troubleshooting](https://support.block64.com/troubleshooting?hsLang=en#main-content) - [Discovery: General Knowledge](https://support.block64.com/troubleshooting?hsLang=en#discovery-general-knowledge) - [Discovery: Block 64 Application](https://support.block64.com/troubleshooting?hsLang=en#discovery-block-64-application) - [Discovery: BlockBox Appliance](https://support.block64.com/troubleshooting?hsLang=en#discovery-blockbox-appliance) - [Discovery: Discovery Agent](https://support.block64.com/troubleshooting?hsLang=en#discovery-discovery-agent) - [Insights Calculations](https://support.block64.com/troubleshooting?hsLang=en#insights-calculations) - [Documentation](https://support.block64.com/documentation?hsLang=en#main-content) - [Discovery: General Knowledge](https://support.block64.com/documentation?hsLang=en#discovery-general-knowledge) - [Privacy and Security](https://support.block64.com/documentation?hsLang=en#privacy-and-security) - [Block 64 API](https://support.block64.com/documentation?hsLang=en#block-64-api) - [Integrations](https://support.block64.com/documentation?hsLang=en#integrations) - [FAQs](https://support.block64.com/faqs?hsLang=en#main-content) - [Security](https://support.block64.com/faqs?hsLang=en#security) - [Block 64 Discovery](https://support.block64.com/faqs?hsLang=en#block-64-discovery) - [New Features & Updates](https://support.block64.com/new-features-updates?hsLang=en#main-content) - [New Features & Updates](https://support.block64.com/new-features-updates?hsLang=en#new-features-updates) - [Combine](https://support.block64.com/new-features-updates?hsLang=en#combine) - [Block 64 Discovery](https://support.block64.com/new-features-updates?hsLang=en#block-64-discovery) - [Remote Discovery Agent](https://support.block64.com/new-features-updates?hsLang=en#remote-discovery-agent) - [Combine API](https://support.block64.com/new-features-updates?hsLang=en#combine-api) - [BlockBox Virtual Appliance](https://support.block64.com/new-features-updates?hsLang=en#blockbox-virtual-appliance) [![Logomark - dark](https://support.block64.com/hs-fs/hubfs/Logomark%20-%20dark.png?width=60&height=96&name=Logomark%20-%20dark.png "Logomark - dark")](http://block64.com) 300 Geary Ave, Toronto, ON M6H 2C5, Canada +1 800-875-5260 [www.block64.com](https://www.block64.com/)