Check if IPv6 Listener for WinRM are configured correctly.

[svndh]

In Order to communicate with WinRM correctly and prevent the communication from the error "WS-Management protocol is not supported" the WinRM config hast to be checked.

To sum up

1. If IPv6 is disabled, the IPv6 Filter for the WinRM Listener can be empty.
2. If Ipv6 is enabled on the system, the IPv6 Filter for the WinRM Listener must be configured with *

You can read more in the Advisory article here --> https://web.archive.org/web/20240303080622/https://www.nocodehardening.com/kb/ws-management-protocol-is-not-supported/
EDIT: Now pointing to archive.org, as the article is not available anymore

[TuemmlerKelch]

@svndh How would you suggest checking whether IPv6 is active on the system? Via registry?

[TuemmlerKelch]

@JLFBPro I think we should test this on a device in our test Lab-environment.
Please do the following:

• Change the IPv6 filter on your client device to be empty > Expected result: No WinRM connection can be established.
• Disable IPv6 on the device
  • via Registry, reboot and check device behavior (HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters:DisabledComponents = 255 (decimal))
  • via adapter options and check device behavior (uncheck IPv6 protocol)

After this, please report back to me.

[svndh]

@TuemmlerKelch IPv6 should never me disabled via adapter options - always via registry

@JLFBPro
Apart from that we should also take into account (as well as the ipv6 filter in winrm config) the configured ip adresses for the ipv6 listener (can be requested with the command winrm e winrm/config/listener I am currently not sure how those winrm sections are interdependant (maybe check this value also after you emptied the IPv6 filter in winrm config)

[JLFBPro]

@svndh The adresses shown in the WinRM listener are dependant on the configuration of the IPv6Filter in winrm/config. For example, all IPv6 adresses vanish in the listener if you empty the IPv6Filter in the config.