How to Completely Disable ‘Windows Remote Management’ (WinRM) via Group Policy in Windows 11

Windows Remote Management (WinRM) is a powerful, native Windows service that implements the WS-Management protocol (based on SOAP). It is the underlying engine that allows administrators to execute PowerShell commands, retrieve WMI data, and manage Windows 11 endpoints remotely over the network. While WinRM is indispensable in massive, heavily automated Active Directory environments relying on PowerShell Remoting, it represents a catastrophic attack surface in strict zero-trust environments, standalone kiosks, or highly secure enclaves. If left enabled on an endpoint without strict firewall rules and certificate-based mutual authentication, WinRM provides an attacker with a high-privilege, network-accessible shell. In environments where endpoints are managed via local MDM agents (like Microsoft Intune) rather than direct network polling, the WinRM listener should be entirely eradicated.

This guide explains how to completely disable ‘Windows Remote Management’ (WinRM) via Group Policy in Windows 11, enforcing a strict zero-trust model where the endpoint refuses all remote PowerShell and WS-Management connections.

Disable Windows Remote Management (WinRM) via Group Policy

To enforce a strict block that permanently neutralizes the WinRM service and prevents it from binding to any network ports, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service

5. In the right-hand pane, locate the policy named Allow remote server management through WinRM.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled. (By explicitly disabling this policy, we instruct the Windows kernel to permanently tear down any active WinRM HTTP/HTTPS listeners (typically ports 5985/5986) and completely reject incoming WS-Management traffic).
8. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes affecting core system services require the system to refresh its configuration.

To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, open an elevated PowerShell prompt and execute the command winrm enumerate winrm/config/listener. The command will return an error indicating that the WinRM service cannot process the request, or that no listeners are configured. Furthermore, running netstat -an | findstr 5985 will yield no results, confirming the port is closed. The Windows 11 workstation is now cryptographically bound to a strict, non-listening state regarding remote PowerShell management.