{"record":{"id":"4e0b5c818dc25ee6","repo":"hashicorp/vagrant","slug":"unable-to-establish-a-remote-powershell-connection","errorCode":null,"errorMessage":"Unable to establish a remote PowerShell connection with the guest. Check if the firewall rules on the guest allow connections to the Windows remote management service.","messagePattern":"Unable to establish a remote PowerShell connection with the guest\\. Check if the firewall rules on the guest allow connections to the Windows remote management service\\.","errorType":"exception","errorClass":"VagrantPlugins::CommandPS::Errors::PSRemotingUndetected","httpStatus":null,"severity":"error","filePath":"plugins/commands/powershell/command.rb","lineNumber":114,"sourceCode":"      end\n\n      def ready_ps_remoting_for(machine, ps_info)\n        machine.ui.output(I18n.t(\"vagrant_ps.detecting\"))\n        script_path = File.expand_path(\"../scripts/enable_psremoting.ps1\", __FILE__)\n        args = []\n        args << \"-hostname\" << ps_info[:host]\n        args << \"-port\" << ps_info[:port].to_s\n        args << \"-username\" << ps_info[:username]\n        args << \"-password\" << ps_info[:password]\n        result = Vagrant::Util::PowerShell.execute(script_path, *args)\n        if result.exit_code != 0\n          raise Errors::PowerShellError,\n            script: script_path,\n            stderr: result.stderr\n        end\n\n        result_output = JSON.parse(result.stdout)\n        raise Errors::PSRemotingUndetected if !result_output[\"Success\"]\n        result_output\n      end\n\n      def reset_ps_remoting_for(machine, ps_info)\n        machine.ui.output(I18n.t(\"vagrant_ps.resetting\"))\n        script_path = File.expand_path(\"../scripts/reset_trustedhosts.ps1\", __FILE__)\n        args = []\n        args << \"-hostname\" << ps_info[:host]\n        result = Vagrant::Util::PowerShell.execute(script_path, *args)\n        if result.exit_code != 0\n          raise Errors::PowerShellError,\n            script: script_path,\n            stderr: result.stderr\n        end\n      end\n    end\n  end\nend","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/hashicorp/vagrant/blob/35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5/plugins/commands/powershell/command.rb#L96-L132","documentation":"After enable_psremoting.ps1 exits 0, `vagrant powershell` parses its JSON stdout; if result['Success'] is false, Errors::PSRemotingUndetected is raised. The script ran, but its probe could not confirm that PS remoting to the guest is actually usable — typically the Windows Remote Management service on the guest is not reachable or not listening.","triggerScenarios":"Guest firewall blocks Windows Remote Management (5985/5986); WinRM listener not configured on the guest (service stopped or Enable-PSRemoting never run); HTTPS-only WinRM while the probe uses HTTP.","commonSituations":"Locked-down corporate Windows images; guests cloned from templates without running sysprep/Enable-PSRemoting; NAT/private networks where the detection targets the wrong interface.","solutions":["Open Windows Remote Management in the guest firewall: allow inbound TCP 5985 (and 5986 if HTTPS).","Run `Enable-PSRemoting -Force` inside the guest (via `vagrant provision` with a shell provisioner or another communicator) and retry.","If WinRM requires HTTPS, configure winrm transport https and port 5986 in the Vagrantfile."],"exampleFix":"# before: guest firewall blocks WinRM\n# after: guest-side rule allowing remote management\nc.vm.provision \"shell\", inline: \"netsh advfirewall firewall add rule name='WinRM-HTTP' dir=in action=allow protocol=TCP localport=5985\"","handlingStrategy":"try-catch","validationCode":"# Pre-flight from the host (Windows): can we see remoting on the guest?\nsystem('powershell', '-Command', \"Test-WSMan -ComputerName #{guest_ip}\") or\n  abort 'PS remoting not detected on guest; enable it or open firewall 5985'","typeGuard":null,"tryCatchPattern":"begin\n  env.cli(['powershell'])\nrescue VagrantPlugins::CommandPowershell::Errors::PSRemotingUndetected => e\n  warn e.message # guest-side: firewall 5985/5986 + Enable-PSRemoting, then retry once\n  exit 1\nend","preventionTips":["Bake Enable-PSRemoting -Force plus firewall rules into Windows guest images.","For HTTPS-only environments, set winrm transport to https and port 5986.","Provision remoting via shell provisioner on first boot instead of assuming it."],"tags":["vagrant","powershell","winrm","remoting","firewall"],"backgroundTag":"powershell-remoting-failed","analyzedSha":"35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5","analyzedAt":"2026-08-21T13:34:32.514Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}