#LocalAccountTokenFilterPolicy reverts to 0

1 messages · Page 1 of 1 (latest)

sharp musk Sep 28, 2022, 12:22 AM

I'm utilizing a Windows Server 2019 CIS image from the Azure Marketplace. It has a local GPO applied that sets LocalAccountTokenFilterPolicy to 0. This seems to break WinRM. I can connect via WinRM if I set it to 1, but the group policy reverts it on reboot. What's the proper way to get WinRM working? I assume removing the GPO is not recommended.

sharp musk Sep 28, 2022, 12:37 PM

So if anyone is curious I think this behavior is intentional. They want to force you to use a domain-joined user account instead of a local user.

Relevant section from the CIS documentation.