Connecting to remote server in SAM fails and message indicates that WinRM cannot complete the operation

10/9/2018 9:05 PM

11/27/2024 5:11 AM

A SAM component monitor returns the following error:

Connecting to remote server failed with the following error message : WinRM cannot complete the operation. Verify that the specified 
computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is 
enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote 
computers within the same local subnet.

Sample Image:
 

This is typically found when assigning the AppInsight for IIS or AppInsight for Exchange application templates. These templates both utilize Powershell component monitors that require the configuration of Windows RM on the polling engine and the target server. 

You may also receive the following message when attempting to enter the application details page for the first time.
 

Server Configuration Failed.
An error occurred during server configuration (Error code: 255). The extended attributes are inconsistent

Sample Image:
 

Server Application Monitor

WinRM configuration on the target server is incorrect or non-existent.

1. Verify that the WinRM service is started and Automatic.
2. Make sure that there is no firewall in between the Orion server, or if there is, there are exceptions for port 5985 for HTTP, and/or 5986 for HTTPS.
3. If those are verified, from an administrator command prompt run:

   winrm quickconfig -q

This will correct any issues found automatically, such as the LocalAccountTokenFilterPolicy, and you are ready to test again.

You may need to set trusted hosts on both the target server and the polling server. If using an Orion Agent, trusted hosts do not need to be set.

1. Open PowerShell as Administrator.
2. Run this command to view TrustedHosts value: 

   ## Scripts are not supported under any SolarWinds support program or service.
   ## Scripts are provided AS IS without warranty of any kind. SolarWinds further
   ## disclaims all warranties including, without limitation, any implied warranties
   ## of merchantability or of fitness for a particular purpose. The risk arising
   ## out of the use or performance of the scripts and documentation stays with you.
   ## In no event shall SolarWinds or anyone else involved in the creation,
   ## production, or delivery of the scripts be liable for any damages whatsoever
   ## (including, without limitation, damages for loss of business profits, business
   ## interruption, loss of business information, or other pecuniary loss) arising
   ## out of the use of or inability to use the scripts or documentation.
   
   Get-Item WSMan:\localhost\Client\TrustedHosts

3. To set TrustedHosts value: 

   ## Scripts are not supported under any SolarWinds support program or service.
   ## Scripts are provided AS IS without warranty of any kind. SolarWinds further
   ## disclaims all warranties including, without limitation, any implied warranties
   ## of merchantability or of fitness for a particular purpose. The risk arising
   ## out of the use or performance of the scripts and documentation stays with you.
   ## In no event shall SolarWinds or anyone else involved in the creation,
   ## production, or delivery of the scripts be liable for any damages whatsoever
   ## (including, without limitation, damages for loss of business profits, business
   ## interruption, loss of business information, or other pecuniary loss) arising
   ## out of the use of or inability to use the scripts or documentation.
   
   winrm set winrm/config/client '@{TrustedHosts="*"}'

   This command sets the TrustedHosts to an asterisk which is a Wildcard. You may replace this with the server IP it needs to trust (comma separated for multiple servers). The target server needs to trust the polling engine IP, and the polling engine IP needs to trust the target server IP. It is recommended that polling engines are always set to asterisk since they may poll multiple servers and need to trust those servers.
4. View the newly set TrustedHosts with the Get-Item command in Step 2.

If using AppInsight for IIS or AppInsight for Exchange templates, you may need to set the application to use an HTTP listener instead of an HTTPS listener (the default setting is an HTTPS listener).

See Create a WinRM HTTPS listener. 

To change the HTTPS listener type, edit the application monitor (Go to the Application Details page > Edit application monitor in the upper right or the Management resource). Change the PowerShell- Windows URL from the default (https://${IP}:5986/wsman/) to the HTTP listener (http://${IP}:5985/wsman/) if you have not built an HTTPS listener in the article above. 
 
Documentation topics related to WinRM include:

• Configure WinRM polling in your SAM environment
• Use WinRM for application monitor polling in SAM  (applies to SAM 2020.2 or later)
• Create a WinRM listener for AppInsight for IIS
• Troubleshoot application monitor polling with WinRM