Recently started getting a few scattered event 10154 source WinRm. - Machine 
is SBS 2003 standard R2.

Full message:
The WinRM service failed to create the following SPNs: 
WSMAN/munged01.munged.local; WSMAN/munged01.
Additional Data
The error received was 8344: Insufficient access rights to perform the 
operation. .
User Action
The SPNs can be created by an administrator using setspn.exe utility.

While doing a little research on this, my understanding is that WinRM is an 
SBS 2008 thing.

Can I safely ignore this event? if not, how to clear it?

WinRM is part of the Windows Management Framework and is available as a 
download for 2003 *and* 2008.  Since that is the listed source in your event 
viewer, I'm guessing that at some point you approved the installation of the 
framework via windows update or WSUS and it is installed on your server.

As far as the log goes, WinRM is just telling you that it has not been given 
permission to listen for commands on the network. If you don't use WinRM 
then this is normal and you can ignore the messages.  If you want to enable 
remote management of the machine then you'll want to refer to the technet 
articles on WinRM to properly enable and secure remote management.

-Cliff




"M. Murphy" <MMurphy@discussions.microsoft.com> wrote in message 
news:ucGW11#hKHA.4220@TK2MSFTNGP05.phx.gbl...
> Recently started getting a few scattered event 10154 source WinRm. - 
> Machine is SBS 2003 standard R2.
>
> Full message:
> The WinRM service failed to create the following SPNs: 
> WSMAN/munged01.munged.local; WSMAN/munged01.
> Additional Data
> The error received was 8344: Insufficient access rights to perform the 
> operation. .
> User Action
> The SPNs can be created by an administrator using setspn.exe utility.
>
> While doing a little research on this, my understanding is that WinRM is 
> an SBS 2008 thing.
>
> Can I safely ignore this event? if not, how to clear it?
>
> 

Thank you Cliff, I can sleep a little easier tonight.

I will look up the remote management, but I don't think I will need it, I 
can do any management remotely by using RWW or Remote Desktop when needed.


"Cliff Galiher" <cgaliher@gmail.com> wrote in message 
news:ueh2CMAiKHA.4872@TK2MSFTNGP05.phx.gbl...
> WinRM is part of the Windows Management Framework and is available as a 
> download for 2003 *and* 2008.  Since that is the listed source in your 
> event viewer, I'm guessing that at some point you approved the 
> installation of the framework via windows update or WSUS and it is 
> installed on your server.
>
> As far as the log goes, WinRM is just telling you that it has not been 
> given permission to listen for commands on the network. If you don't use 
> WinRM then this is normal and you can ignore the messages.  If you want to 
> enable remote management of the machine then you'll want to refer to the 
> technet articles on WinRM to properly enable and secure remote management.
>
> -Cliff
>
>
>
>
> "M. Murphy" <MMurphy@discussions.microsoft.com> wrote in message 
> news:ucGW11#hKHA.4220@TK2MSFTNGP05.phx.gbl...
>> Recently started getting a few scattered event 10154 source WinRm. - 
>> Machine is SBS 2003 standard R2.
>>
>> Full message:
>> The WinRM service failed to create the following SPNs: 
>> WSMAN/munged01.munged.local; WSMAN/munged01.
>> Additional Data
>> The error received was 8344: Insufficient access rights to perform the 
>> operation. .
>> User Action
>> The SPNs can be created by an administrator using setspn.exe utility.
>>
>> While doing a little research on this, my understanding is that WinRM is 
>> an SBS 2008 thing.
>>
>> Can I safely ignore this event? if not, how to clear it?
>>
>> 

So, why do you banter so much and not answer  the question. This thread 
basically says NOTHING but to go somewhere else for what the EVENT Log 
already says. Is this a social club? How about limiting your 'resolutions' to 
something with some meat on the bones.

The irony is that this post has no meat either. It just says I wasted my 
time searching the web to find some people rambling which lead to what you 
already knew. AKA: waste of time.

"M. Murphy" wrote:

> Thank you Cliff, I can sleep a little easier tonight.
> 
> I will look up the remote management, but I don't think I will need it, I 
> can do any management remotely by using RWW or Remote Desktop when needed.
> 
> 
> "Cliff Galiher" <cgaliher@gmail.com> wrote in message 
> news:ueh2CMAiKHA.4872@TK2MSFTNGP05.phx.gbl...
> > WinRM is part of the Windows Management Framework and is available as a 
> > download for 2003 *and* 2008.  Since that is the listed source in your 
> > event viewer, I'm guessing that at some point you approved the 
> > installation of the framework via windows update or WSUS and it is 
> > installed on your server.
> >
> > As far as the log goes, WinRM is just telling you that it has not been 
> > given permission to listen for commands on the network. If you don't use 
> > WinRM then this is normal and you can ignore the messages.  If you want to 
> > enable remote management of the machine then you'll want to refer to the 
> > technet articles on WinRM to properly enable and secure remote management.
> >
> > -Cliff
> >
> >
> >
> >
> > "M. Murphy" <MMurphy@discussions.microsoft.com> wrote in message 
> > news:ucGW11#hKHA.4220@TK2MSFTNGP05.phx.gbl...
> >> Recently started getting a few scattered event 10154 source WinRm. - 
> >> Machine is SBS 2003 standard R2.
> >>
> >> Full message:
> >> The WinRM service failed to create the following SPNs: 
> >> WSMAN/munged01.munged.local; WSMAN/munged01.
> >> Additional Data
> >> The error received was 8344: Insufficient access rights to perform the 
> >> operation. .
> >> User Action
> >> The SPNs can be created by an administrator using setspn.exe utility.
> >>
> >> While doing a little research on this, my understanding is that WinRM is 
> >> an SBS 2008 thing.
> >>
> >> Can I safely ignore this event? if not, how to clear it?
> >>
> >> 
> 
> 
> .
> 

The question was "Can I safely ignore this event?" and my answer was *quite* 
clear.  So your statement that I didn't answer the question is quite 
obviously wrong.

The problem is that you assume everyone has the same level of knowledge as 
you do.  Some people see a warning in the event log, and regardless of what 
the event text says, they are concerned because it is a "warning."  To 
someone in that situation, my answer was concise and to the point.

Now if you have a question of your own to ask, feel free to ask at and see 
who helps.

-Cliff


"d-b-s" <d-b-s@discussions.microsoft.com> wrote in message 
news:2C34889B-FF55-4512-9050-AB6A1BBFF1A4@microsoft.com...
> So, why do you banter so much and not answer  the question. This thread
> basically says NOTHING but to go somewhere else for what the EVENT Log
> already says. Is this a social club? How about limiting your 'resolutions' 
> to
> something with some meat on the bones.
>
> The irony is that this post has no meat either. It just says I wasted my
> time searching the web to find some people rambling which lead to what you
> already knew. AKA: waste of time.
>
> "M. Murphy" wrote:
>
>> Thank you Cliff, I can sleep a little easier tonight.
>>
>> I will look up the remote management, but I don't think I will need it, I
>> can do any management remotely by using RWW or Remote Desktop when 
>> needed.
>>
>>
>> "Cliff Galiher" <cgaliher@gmail.com> wrote in message
>> news:ueh2CMAiKHA.4872@TK2MSFTNGP05.phx.gbl...
>> > WinRM is part of the Windows Management Framework and is available as a
>> > download for 2003 *and* 2008.  Since that is the listed source in your
>> > event viewer, I'm guessing that at some point you approved the
>> > installation of the framework via windows update or WSUS and it is
>> > installed on your server.
>> >
>> > As far as the log goes, WinRM is just telling you that it has not been
>> > given permission to listen for commands on the network. If you don't 
>> > use
>> > WinRM then this is normal and you can ignore the messages.  If you want 
>> > to
>> > enable remote management of the machine then you'll want to refer to 
>> > the
>> > technet articles on WinRM to properly enable and secure remote 
>> > management.
>> >
>> > -Cliff
>> >
>> >
>> >
>> >
>> > "M. Murphy" <MMurphy@discussions.microsoft.com> wrote in message
>> > news:ucGW11#hKHA.4220@TK2MSFTNGP05.phx.gbl...
>> >> Recently started getting a few scattered event 10154 source WinRm. -
>> >> Machine is SBS 2003 standard R2.
>> >>
>> >> Full message:
>> >> The WinRM service failed to create the following SPNs:
>> >> WSMAN/munged01.munged.local; WSMAN/munged01.
>> >> Additional Data
>> >> The error received was 8344: Insufficient access rights to perform the
>> >> operation. .
>> >> User Action
>> >> The SPNs can be created by an administrator using setspn.exe utility.
>> >>
>> >> While doing a little research on this, my understanding is that WinRM 
>> >> is
>> >> an SBS 2008 thing.
>> >>
>> >> Can I safely ignore this event? if not, how to clear it?
>> >>
>> >>
>>
>>
>> .
>>