Winrm

pcheh

Ok guys im at a lose now. I ran winrm quick config on a new windows 22 server i set up a user in the remote monitoring group. I tested the connection on a remote pc with the credentials and that works. But i can not get solar winds to add the node, i just get test failed. What can i be missing i even set up an https listener and created/exported a cert.

Thanks for any help.

ronan.tonilon

Disclaimer:
The content posted herein are provided as a suggestion or recommendation to you for your internal use. The information set forth herein may come from third party website or customers. SolarWinds is not liable for any downtime or any issue that may occur if you perform the following suggestions on the link provided. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.
Please try this first in a lab environment, before implementing to your production.

You can open a support ticket to get insights, but please take note of our Working with Support Policy, customizations are not supported especially if this would involved custom scripts or queries, support can assist in a best effort practice since our support team is intended as a break fix support.

You've done most of the right steps by:

• Running winrm quickconfig

• Setting up the user in the Remote Management Users group

• Configuring HTTPS WinRM with a certificate

• Testing WinRM manually (e.g., via PowerShell from another PC)

But SolarWinds still fails to add the node. Here are the most common causes and fixes for this problem when monitoring a Windows Server 2022 via WMI/WinRM:

Quick Checklist for Successful SolarWinds WMI/WinRM Connection

1. User Permissions: Needs More Than Remote Management Group

Even though you added the user to Remote Management Users, SolarWinds often expects:

• Membership in Distributed COM Users

• WMI namespace permissions for root\cimv2 and root\virtualization\v2

Fix:

1. Open wmimgmt.msc on the target server

2. Right-click WMI Control > Properties > Security

3. Expand Root > CIMV2, then:

   • Click Security

   • Add your monitoring user

   • Grant Enable Account, Remote Enable, and Read

Do the same under:

• Root\Virtualization

• Root\Microsoft\Windows\Defender (if you monitor AV status)

2. Firewall Ports

Even with HTTPS configured, the Windows Firewall might block traffic.

Fix:
Ensure the following inbound rules are enabled:

• Windows Remote Management (HTTP-In) → TCP 5985

• Windows Remote Management (HTTPS-In) → TCP 5986

• Custom rules if needed for your cert-based listener

Run on the target server:

<span>Enable-NetFirewallRule -DisplayGroup "Windows Remote Management"</span>

3. Trusted Certificate (for HTTPS WinRM)

SolarWinds requires the certificate CN to match the hostname of the node.

Fix:

• Ensure your cert's subject CN is the FQDN or host name that SolarWinds is trying to connect to.

• If SolarWinds uses the IP to connect, and the cert is hostname-based, it will fail validation.

Recommended: Use HTTP over trusted internal networks first. HTTPS is good for compliance but more complex to get working initially.

4. WinRM Listener Check

Ensure the HTTPS listener is correctly bound.

Run this:

<span>winrm enumerate winrm/config/listener</span>

Check that:

• A listener on port 5986 exists

• It uses your installed certificate

• IP/hostname matches what SolarWinds connects to

5. Manual WinRM Test from SolarWinds Server

From your SolarWinds server:

<span>Test-WsMan -ComputerName yourserver.domain.local -Credential (Get-Credential)</span>

<code class="whitespace-pre! language-powershell">

This should return WinRM info.
If using HTTPS:

<code class="whitespace-pre! language-powershell">

<span>Test-WsMan -ComputerName yourserver.domain.local -UseSSL</span>

</code></div><div class="overflow-y-auto p-4" dir="ltr"><code class="whitespace-pre! language-powershell"><code class="whitespace-pre! language-powershell"><span></span>

6. Use “Agent” Instead of WMI (Optional)

<code class="whitespace-pre! language-powershell"><span></span>

SolarWinds agent-based monitoring avoids all these WMI/WinRM complexities and works securely over 17778.

<code class="whitespace-pre! language-powershell"><span></span>

Try this if:

<code class="whitespace-pre! language-powershell"><span></span>

• You control both ends

• You’re stuck troubleshooting WinRM

PowerShell script that configures a Windows Server 2022 system to be properly monitored via SolarWinds using WMI/WinRM (HTTP or HTTPS). This script

• Ensures the required services are running
• Grants necessary WMI namespace permissions
• Adds the user to key local groups
• Enables the correct firewall rules
• Validates and enables the WinRM listener

PowerShell Script: Configure Windows for SolarWinds WMI Monitoring

<span># CONFIGURATION </span>

<span>$MonitoringUser = "DOMAIN\\SolarWindsUser" # Replace with your actual domain\user </span>

<span>$UseHTTPS = $false # Set to $true if using HTTPS with certs </span>

<span></span>

<span># Ensure WinRM service is enabled </span>

<span>Write-Host "Configuring WinRM..." </span>

<span>Enable-PSRemoting -Force </span>

</code></div><div class="overflow-y-auto p-4" style="padding-left:30px;" dir="ltr"><code class="whitespace-pre! language-powershell"><span># Add user to necessary local groups </span>

<span>Write-Host "Adding user to local groups..." </span>

<span>Add-LocalGroupMember -Group "Distributed COM Users" -Member $MonitoringUser -ErrorAction SilentlyContinue </span>

<span>Add-LocalGroupMember -Group "Remote Management Users" -Member $MonitoringUser -ErrorAction SilentlyContinue </span>

</code></div><div class="overflow-y-auto p-4" style="padding-left:30px;" dir="ltr"><code class="whitespace-pre! language-powershell"><span># Set WMI namespace permissions </span>

<span>$namespaces = @("root\cimv2", "root\virtualization\v2", "root\Microsoft\Windows\Defender") </span>

</code></div><div class="overflow-y-auto p-4" style="padding-left:30px;" dir="ltr"><code class="whitespace-pre! language-powershell"><span>foreach ($namespace in $namespaces) { </span>

<span>&nbsp; Write-Host "Configuring WMI permissions for $namespace..." </span>

<span>&nbsp; $wmipath = [WMIClass]"\\localhost\${namespace}:__SystemSecurity" </span>

<span>&nbsp; $sd = $wmipath.PSBase.GetSecurityDescriptor() </span>

<span>&nbsp; $trustee = ([WMIClass]"Win32_Trustee").CreateInstance() </span>

<span>&nbsp; $trustee.Domain = $MonitoringUser.Split("\\")[0] </span>

<span>&nbsp; $trustee.Name = $MonitoringUser.Split("\\")[1] </span>

<span>&nbsp; $trustee.SID = ([System.Security.Principal.NTAccount]$MonitoringUser).Translate([System.Security.Principal.SecurityIdentifier]).Value </span>

</code></div><div class="overflow-y-auto p-4" style="padding-left:30px;" dir="ltr"><code class="whitespace-pre! language-powershell"><span>&nbsp; $ace = ([WMIClass]"Win32_Ace").CreateInstance() </span>

<span>&nbsp; $ace.AccessMask = 0x00000001 + 0x00000010 + 0x00000020 # Execute, Read Security, Enable </span>

<span>&nbsp; $ace.AceFlags = 0 $ace.AceType = 0 </span>

<span>&nbsp; $ace.Trustee = $trustee </span>

</code></div><div class="overflow-y-auto p-4" style="padding-left:30px;" dir="ltr"><code class="whitespace-pre! language-powershell"><span>&nbsp; $sd.DACL += $ace </span>

<span>&nbsp; $wmipath.PSBase.SetSecurityDescriptor($sd) | Out-Null </span>

<span>} </span>

</code></div><div class="overflow-y-auto p-4" style="padding-left:30px;" dir="ltr"><code class="whitespace-pre! language-powershell"><span># Enable WinRM Firewall rules </span>

<span>Write-Host "Enabling firewall rules..." </span>

<span>Enable-NetFirewallRule -DisplayGroup "Windows Remote Management" </span>

</code></div><div class="overflow-y-auto p-4" style="padding-left:30px;" dir="ltr"><code class="whitespace-pre! language-powershell"><span># Configure WinRM listener </span>

<span>if ($UseHTTPS) { </span>

<span>&nbsp; Write-Host "Verifying HTTPS listener..." </span>

<span>&nbsp; $listener = winrm enumerate winrm/config/listener </span>

<span>&nbsp; if (-not ($listener -match "Transport = HTTPS")) { </span>

<span>&nbsp; &nbsp; Write-Host "No HTTPS listener found. You must manually configure a certificate-bound listener." -ForegroundColor Yellow </span>

<span>&nbsp; } else { </span>

<span>&nbsp; &nbsp; Write-Host "HTTPS listener found." </span>

<span>&nbsp; } </span>

<span>} else { </span>

<span>&nbsp; Write-Host "Enabling HTTP listener on port 5985..." </span>

<span>&nbsp; winrm quickconfig -quiet </span>

<span>}</span>

</code></div><div class="overflow-y-auto p-4" style="padding-left:30px;" dir="ltr"><code class="whitespace-pre! language-powershell"><span> </span>

Write-Host "`n<img src="https://us.v-cdn.net/6038570/uploads/system/emoji/2705.svg" height="16px" width="16px">&nbsp;Configuration complete. Test WMI access from SolarWinds server.

</code></div><div class="overflow-y-auto p-4" dir="ltr"><code class="whitespace-pre! language-powershell"><code class="whitespace-pre! language-powershell">

Note:

<code class="whitespace-pre! language-powershell">

• This script assumes the user is already created and part of the domain.

• You must run this script as an Administrator on the target server.

• For HTTPS, the script doesn’t auto-create the certificate or bind it (that’s a separate secure step).

• This script does not reboot the server — safe for use during business hours if non-disruptive.

After Running

From your SolarWinds server, test the WMI/WinRM access:

<span>Test-WsMan -ComputerName your-node.domain.local -Credential (Get-Credential)</span>

</code></div><div class="overflow-y-auto p-4" dir="ltr"><code class="whitespace-pre! language-powershell"><span><br />Hope this helps.</span>

<span></span>

<span></span>