How to Configure PowerShell Remoting Session Permissions in Windows 11 Using Set-PSSessionConfiguration

In Windows 11 and Windows Server administration, PowerShell Remoting (WinRM) provides a robust framework for executing commands across remote machines. By default, when PowerShell remoting is enabled via Enable-PSRemoting, the operating system creates default session configurations—primarily Microsoft.PowerShell and Microsoft.PowerShell32. For security reasons, Windows restricts connection and execution access on these default endpoints strictly to members of the local Administrators group. However, enterprise organizations frequently require non-administrator user accounts—such as Tier-1 helpdesk technicians, security auditors, and automated monitoring service accounts—to query system information or execute diagnostics without granting them full administrative rights across the machine. Using PowerShell and the Set-PSSessionConfiguration cmdlet, administrators can modify session access control lists (ACLs), enforce execution quotas, and configure idle timeouts.

Architecture of PowerShell Remoting Session Configurations

A PowerShell session configuration (also known as a session endpoint) defines the runtime environment, execution mode, and access permissions for incoming WinRM connections:

• Session Security Descriptors: Each endpoint maintains a security descriptor (in standard Security Descriptor Definition Language, or SDDL) that grants or denies specific rights: Execute (allows connecting and running commands), Read, and FullControl.
• Access Modes: Dictates whether the endpoint allows interactive remote shells (Local or Remote) or is completely disabled.
• Operational Quotas: Controls resource utilization, including -MaxProcessesPerShell, -MaxConcurrentCommandsPerShell, and -MaxMemoryPerShellMB, preventing rogue remote scripts from exhausting host resources.
• Idle Timeouts: Configures how long an inactive remote session remains cached in host memory before being automatically terminated (-IdleTimeoutMs).

Auditing Existing Session Configurations on Windows 11

Before modifying endpoint permissions, review the existing session configurations registered on the system. Launch PowerShell with elevated administrative privileges:

# Query all registered PowerShell remoting endpoints
Get-PSSessionConfiguration

# Display endpoint names and permission descriptors
Get-PSSessionConfiguration | Select-Object Name, Permission, SecurityDescriptorSddl

Observe the Permission string for Microsoft.PowerShell. It typically specifies NT AUTHORITY\INTERACTIVE AccessAllowed and BUILTIN\Administrators AccessAllowed.

Modifying Session Permissions Using an Interactive Security Descriptor

The simplest and safest method to grant remote access to non-administrative security groups without manually editing complex SDDL strings is utilizing the -ShowSecurityDescriptorUI parameter:

# Launch the interactive ACL permission editor for the default endpoint
Set-PSSessionConfiguration -Name "Microsoft.PowerShell" -ShowSecurityDescriptorUI -Force

Executing this command displays the familiar Windows Access Control List dialog:

1. Click Add and specify the desired local or Active Directory security group (for example, Helpdesk-Staff or Monitoring-Service-Accounts).
2. In the permissions list, tick the checkbox for Read(Get,Enumerate,Subscribe) and Execute(Invoke).
3. Click OK to commit the security changes.

Immediately after confirming, PowerShell restarts the WinRM service to reload the updated security descriptor into memory.

Programmatically Assigning Permissions via SDDL Strings

For automated enterprise deployment scripts and Desired State Configuration (DSC) pipelines, define the security descriptor programmatically using SDDL notation:

# Define the custom SDDL string granting Execute rights to a specific SID or group
$sddl = "O:NSG:BAD:P(A;;GA;;;BA)(A;;GXGR;;;S-1-5-21-382910-1001)S:P"

# Apply the SDDL security descriptor to the endpoint
Set-PSSessionConfiguration -Name "Microsoft.PowerShell" -SecurityDescriptorSddl $sddl -Force

Here, GA denotes Generic All (Administrators), while GXGR grants Generic Execute and Generic Read to the specified user or group security identifier (SID).

Configuring Idle Session Timeouts and Process Quotas

To ensure abandoned remote shells do not leak memory or persist indefinitely, apply strict idle timeout and process constraints using Set-PSSessionConfiguration:

# Set idle timeout to 15 minutes (900,000 milliseconds)
Set-PSSessionConfiguration -Name "Microsoft.PowerShell" `
    -IdleTimeoutMs 900000 `
    -MaxProcessesPerShell 15 `
    -MaxMemoryPerShellMB 1024 `
    -Force

# Verify the configured operational parameters
(Get-PSSessionConfiguration -Name "Microsoft.PowerShell").MaxMemoryPerShellMB

Testing Non-Admin Remote Connection Access

To verify that the permissions were applied successfully, test connecting from a client machine using the non-administrator credentials:

# Prompt for non-admin user credentials
$userCred = Get-Credential

# Test connecting to the remote Windows 11 endpoint
Enter-PSSession -ComputerName "192.168.10.50" -Credential $userCred -ConfigurationName "Microsoft.PowerShell"

The non-administrative user connects successfully into the remote session, able to execute allowed commands while remaining constrained by standard operating system user access controls.

Resetting Session Configurations to Default Factory Settings

If permissions need to be revoked or if an endpoint requires factory reset, re-register or restore default security configurations:

# Restore default permissions on the Microsoft.PowerShell endpoint
Set-PSSessionConfiguration -Name "Microsoft.PowerShell" -SecurityDescriptorSddl "O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;RM)S:P" -Force

# Verify that only Administrators hold access
(Get-PSSessionConfiguration -Name "Microsoft.PowerShell").Permission

Managing PowerShell Remoting session permissions deliberately enables secure delegated administration, streamlines remote diagnostics, and enforces the principle of least privilege across enterprise Windows environments.