Allow Basic authentication
This policy value controls whether the Windows Remote Management (WinRM) client is permitted to use Basic authentication.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\WinRM\Client\AllowBasic
This policy value controls whether the Windows Remote Management (WinRM) client is permitted to use Basic authentication. It is a REG_DWORD value: 1 allows Basic authentication, while 0 prevents its use.
The setting makes the authentication method available to the client. It does not force every connection to use Basic authentication or disable other permitted methods such as Kerberos or Negotiate.
Notes
Security
Basic authentication transmits the user name and password in an encoded but cryptographically unprotected form. When WinRM uses HTTP transport, Microsoft’s policy documentation states that these credentials are sent over the network as clear text. An attacker able to observe that traffic could capture and reuse them. With HTTPS transport, TLS protects the credentials while they are in transit.
This setting does not grant additional access to the destination computer. The WinRM service on the destination must separately accept Basic authentication, and the supplied account must still have the permissions required by the WinRM endpoint and the requested management operation.
Possible side effects
When Basic authentication is not allowed, connections to endpoints or management products that support no other authentication method can fail.
Notes
This is a computer-scoped policy value for the WinRM client. It does not configure server-side acceptance of Basic authentication, create WinRM listeners, or control whether WinRM messages may be sent without encryption.
Microsoft documentation
Microsoft Learn: Policy CSP – RemoteManagement – AllowBasicAuthentication_Client
Microsoft Learn: Authentication for Remote Connections