How to Troubleshoot WinRM and Kerberos Errors in Server Manager Print

Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.

This workflow isolates common remote-management failures caused by DNS, firewall, service, listener, time, or Kerberos configuration problems.

Prerequisites

• Console access to the management host and target server.
• Permission to read WinRM configuration and Windows event logs.
• The target hostname and expected DNS records are documented.

Step-by-step procedure

1. Resolve the target FQDN from the management host and confirm it maps to the correct address.
2. Compare system time and domain time source on both computers.
3. Test TCP connectivity and then run Test-WSMan using the FQDN.
4. Verify that the WinRM service is running and that an HTTP listener exists.
5. Review the Windows Remote Management operational log and Kerberos events.
6. Correct DNS, firewall, SPN, or delegation settings individually and retest after each change.

PowerShell commands

Resolve-DnsName server01.contoso.example
w32tm /query /status
Test-NetConnection server01.contoso.example -Port 5985
Test-WSMan server01.contoso.example
Get-Service WinRM
winrm enumerate winrm/config/listener

Verification

Test-WSMan succeeds with the FQDN and Server Manager reports the host as Online with no manageability error.

Rollback

Revert the specific DNS, firewall, listener, SPN, or policy change made during troubleshooting. Do not disable authentication or broaden TrustedHosts as a permanent workaround.

Operational and security notes

• Prefer Kerberos with FQDNs for domain-joined servers.
• Do not use IP addresses for Kerberos authentication.
• Avoid wildcard TrustedHosts entries.
• Capture existing WinRM configuration before changing listeners or authentication settings.

Related resources

For managed Canadian VPS and RDS infrastructure, visit networkmanager.info. See also the official Microsoft Server Manager documentation.