winrm access denied for new user

Question

On windows server 2012 was created new user as administrator. in powershell was started winrm(winrm quickconfig).

But after winrm configSDDL default result is WSMan fault: access denied. What's wrong?

Solution

There are many posts about this exact error message. Here are some excerpts that should help! #LMGTFY :)

From a Symantec KB: https://support.symantec.com/en_US/article.TECH200047.html

This error happens even if the account is a Local Administrator and the command line is run with administrator privileges.

To solve the problem, UAC filtering for local accounts must be disabled by creating the following DWORD registry entry and setting its value to 1:

 [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] LocalAccountTokenFilterPolicy

From a Microsoft forum: https://social.technet.microsoft.com/Forums/office/en-US/e5f8cfee-d4a6-4e5c-9baf-e8a8a67d9316/winrm-access-denied

Because of User Account Control (UAC), the remote account must be a domain account and a member of the remote computer Administrators group. If the account is a local computer member of the Administrators group, then UAC does not allow access to the WinRM service. To access a remote WinRM service in a workgroup, UAC filtering for local accounts must be disabled by creating the following DWORD registry entry and setting its value to 1:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] LocalAccountTokenFilterPolicy

We do have another unanswered question about this. Maybe they can be merged: Enabling Powershell Remoting, Access is denied?