WinRM Listener Registry Path in Windows

This article explains the exact Windows Registry path used to store and control Windows Remote Management (WinRM) listener configurations. It details the specific registry keys responsible for HTTP and HTTPS listeners, the values contained within them, and the recommended methods for managing WinRM settings safely.

The WinRM Listener Registry Key

The primary registry path that stores and controls WinRM listener settings in the Windows Registry Editor (regedit) is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Listener

Within this location, WinRM creates subkeys for each active listener based on the IP binding and transport protocol.

Common subkeys found under this path include:

• *\+HTTP: Contains settings for default HTTP listeners across all IP addresses.
• *\+HTTPS: Contains settings for default HTTPS listeners across all IP addresses.

Key Values Inside the Listener Path

Inside each listener subkey, several DWORD and String values define how WinRM listens for incoming connections:

• Port (DWORD): Specifies the port number used by the listener (default is 5985 for HTTP and 5986 for HTTPS).
• Enabled (DWORD): Controls the operational state of the listener (1 for enabled, 0 for disabled).
• CertificateThumbprint (String): Used in HTTPS listeners to specify the SHA-1 thumbprint of the SSL/TLS certificate bound to the service.
• Hostname (String): Defines the host name or IP address associated with the listener.
• URLPrefix (String): Specifies the URL prefix on which to accept HTTP or HTTPS requests (typically wsman).

General WinRM Service Settings

Broader service-level configurations that affect how listeners operate are located under the parent service registry path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service

This path controls authentication methods (such as Basic, Kerberos, or CredSSP), max concurrent operations, and network timeout values.

Managing WinRM Listeners Safely

While these values can be viewed and edited in regedit, manual changes to the registry can cause service instability if formats are invalid. It is generally recommended to inspect or modify listeners using the built-in management tools:

• WinRM CLI: Run winrm enumerate winrm/config/listener to view listeners, or winrm get winrm/config for the complete configuration.
• PowerShell: Use the WSMan provider via Get-ChildItem -Path WSMan:\localhost\Listener to interact directly with listener configurations through structured commands.