Microsoft-Windows-ServerManager-ConfigureSMRemoting
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 256 | Configure-SMRemoting. | Debug | N | N |
| 257 | Configure-SMRemoting. | Debug | N | N |
| 512 | Configure-SMRemoting. | Debug | N | N |
| 513 | Configure-SMRemoting. | Debug | N | N |
| 514 | Configure-SMRemoting. | Debug | N | N |
| 515 | Configure-SMRemoting. | Debug | N | N |
| 516 | Configure-SMRemoting. | Debug | N | N |
| 517 | Configure-SMRemoting. | Debug | N | N |
| 768 | Configure-SMRemoting. | Debug | N | N |
| 769 | Configure-SMRemoting. | Debug | N | N |
| 1024 | Configure-SMRemoting. | Debug | N | N |
| 1025 | Configure-SMRemoting. | Debug | N | N |
| 1026 | WinRM API invoked: action Action parameters Parameters. | Debug | N | N |
| 1027 | WinRM API return: action Action parameters Parameters ErrorCode ErrorCode result … | Debug | N | N |
| 1281 | The testability key HKLM\\SOFTWARE\\Microsoft\\ServerManager\\Testability is … | Operational | N | N |
| 1282 | Configure-SMRemoting. | Operational | N | N |
| 1283 | Configure-SMRemoting. | Operational | N | N |
| 1284 | Configure-SMRemoting. | Operational | N | N |
| 1285 | Configure-SMRemoting. | Operational | N | N |
| 1286 | Configure-SMRemoting. | Operational | N | N |
| 1287 | Configure-SMRemoting. | Operational | N | N |
Event ID 257: Configure-SMRemoting.
#Event ID 513: Configure-SMRemoting.
#Event ID 514: Configure-SMRemoting.
#Description
Configure-SMRemoting.exe -ENABLE invokes PowerShell.exe Enable-PSRemoting.
Message #
Event ID 515: Configure-SMRemoting.
#Description
Configure-SMRemoting.exe -ENABLE completes PowerShell.exe Enable-PSRemoting.
Message #
Event ID 516: Configure-SMRemoting.
#Event ID 517: Configure-SMRemoting.
#Event ID 769: Configure-SMRemoting.
#Event ID 1024: Configure-SMRemoting.
#Event ID 1025: Configure-SMRemoting.
#Event ID 1026: WinRM API invoked: action Action parameters Parameters.
#Event ID 1027: WinRM API return: action Action parameters Parameters ErrorCode ErrorCode result Result.
#Event ID 1281: The testability key HKLM\\SOFTWARE\\Microsoft\\ServerManager\\Testability is present.
#Description
The testability key HKLM\\SOFTWARE\\Microsoft\\ServerManager\\Testability is present. This registry key is for debugging purposes only and can override the normal behavior of Configure-SMRemoting.exe. It is recommended to delete this key.
Message #
Event ID 1282: Configure-SMRemoting.
#Event ID 1283: Configure-SMRemoting.
#Event ID 1284: Configure-SMRemoting.
#Event ID 1285: Configure-SMRemoting.
#Event ID 1286: Configure-SMRemoting.
#Provenance
ETW provider GUID 6e27f02d-8a55-477e-88b5-6f1ba07e14b4
Defined in Configure-SMRemoting.exe, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB