Windows Event ID 4801 – Microsoft-Windows-WinRM: WinRM Service Started Successfully

Check the WinRM operational log to confirm service startup details and identify any related events.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Applications and Services Logs → Microsoft → Windows → WinRM → Operational
3. Look for Event ID 4801 entries to confirm successful service starts
4. Check surrounding events for any warnings or errors that might indicate issues
5. Right-click on Event ID 4801 entries and select Event Properties to view detailed information

Use PowerShell to query WinRM events programmatically:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WinRM/Operational'; Id=4801} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Verify the WinRM service configuration to ensure it's set up correctly for your environment.

1. Open PowerShell as Administrator
2. Check the current WinRM service status:

Get-Service WinRM | Format-List Name, Status, StartType, ServiceType

3. Verify WinRM configuration:

winrm get winrm/config

4. Check WinRM listeners:

winrm enumerate winrm/config/listener

5. Test WinRM connectivity locally:

Test-WSMan -ComputerName localhost

If the service isn't running, start it manually:

Start-Service WinRM

Investigate WinRM service dependencies and startup behavior to identify potential issues.

1. Check service dependencies using PowerShell:

Get-Service WinRM | Select-Object -ExpandProperty ServicesDependedOn

2. Review services that depend on WinRM:

Get-Service | Where-Object {$_.ServicesDependedOn -contains (Get-Service WinRM)}

3. Check the Windows Event Log for service startup issues:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} | Where-Object {$_.Message -like '*WinRM*'} | Select-Object TimeCreated, Message

4. Verify WinRM service registry configuration:

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\WinRM' | Select-Object Start, Type, ImagePath

5. Check for Group Policy settings affecting WinRM:

gpresult /h c:\temp\gpresult.html

Open the generated HTML file and search for WinRM-related policies.

Track WinRM service performance and resource consumption to identify potential issues.

1. Monitor WinRM process resource usage:

Get-Process -Name 'winrm' | Select-Object ProcessName, Id, CPU, WorkingSet, VirtualMemorySize

2. Check WinRM performance counters:

Get-Counter '\WS-Management Listener(*)*' -MaxSamples 5 -SampleInterval 2

3. Monitor WinRM connections and sessions:

Get-WSManInstance -ResourceURI winrm/config/service -ComputerName localhost

4. Set up continuous monitoring of WinRM events:

Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Microsoft-Windows-WinRM/Operational' AND EventCode=4801" -Action {Write-Host "WinRM service started at $(Get-Date)"}

5. Create a custom PowerShell script to log WinRM startup events:

$logPath = "C:\Logs\WinRM_Monitoring.log"
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WinRM/Operational'; Id=4801} -MaxEvents 1 | ForEach-Object {
    "$(Get-Date): WinRM started - Process ID: $($_.ProcessId)" | Out-File -FilePath $logPath -Append
}

Perform comprehensive WinRM analysis including security configuration and advanced diagnostics.

1. Enable detailed WinRM logging for troubleshooting:

winrm set winrm/config/service @{EnableCompatibilityHttpListener="true"}
wevtutil set-log Microsoft-Windows-WinRM/Analytic /enabled:true
wevtutil set-log Microsoft-Windows-WinRM/Debug /enabled:true

2. Analyze WinRM security configuration:

winrm get winrm/config/service/auth
winrm get winrm/config/client/auth

3. Check WinRM SSL certificate configuration:

Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like '*' -and $_.EnhancedKeyUsageList -like '*Server Authentication*'}

4. Perform network connectivity testing:

Test-NetConnection -ComputerName localhost -Port 5985 -InformationLevel Detailed
Test-NetConnection -ComputerName localhost -Port 5986 -InformationLevel Detailed

5. Generate comprehensive WinRM diagnostic report:

$report = @{}
$report.ServiceStatus = Get-Service WinRM
$report.Configuration = winrm get winrm/config
$report.Listeners = winrm enumerate winrm/config/listener
$report.RecentEvents = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WinRM/Operational'; Id=4801} -MaxEvents 5
$report | ConvertTo-Json -Depth 3 | Out-File -FilePath "C:\Temp\WinRM_Diagnostic_Report.json"