ADMX Viewer
Microsoft.Policies.WindowsRemoteManagement• Machine

Specify channel binding token hardening level

This policy setting allows you to set the hardening level of the Windows Remote Management (WinRM) service with regard to channel binding tokens. If you enable this policy setting, the WinRM service uses the level specified in HardeningLevel to determine whether or not to accept a received request, based on a supplied channel binding token. If you disable or do not configure this policy setting, you can configure the hardening level locally on each computer. If HardeningLevel is set to Strict, any request not containing a valid channel binding token is rejected. If HardeningLevel is set to Relaxed (default value), any request containing an invalid channel binding token is rejected. However, a request that does not contain a channel binding token is accepted (though it is not protected from credential-forwarding attacks). If HardeningLevel is set to None, all requests are accepted (though they are not protected from credential-forwarding attacks).

Policy Details

Policy Name
CBTHardeningLevel_1
Registry Key
Software\Policies\Microsoft\Windows\WinRM\Service
Value Name
CBTHardeningLevelStatus
Supported On
At least Windows Vista
OMA-URI (CSP)
RemoteManagement/SpecifyChannelBindingTokenHardeningLevel
OS Build Version:10.0.16299
CSP Version:6.0
Conflict Resolution:LastWrite
Allowed Editions:
EnterpriseEnterprise NProfessionalProfessional NEnterprise EvaluationEnterprise N EvaluationEducationEducation NEnterprise SEnterprise S NEnterprise S EvaluationEnterprise S N EvaluationPro Single LanguagePro ChinaPro WorkstationPro Workstation NPro For EducationPro For Education NEnterprisegEnterprisegnServerrdshIotenterpriseIotenterprisesCloudeditionnCloudeditionIotenterpriseskIotenterpriseseval
Available Languages
en-us

Configuration Elements

Hardening Level:

Type: enum

Allowed Values
  • None None
  • Relaxed Relaxed
  • Strict Strict