This policy setting allows you to manage whether the Windows Remote Management (WinRM) client will not use Digest authentication. If you enable this policy setting, the WinRM client will not use Digest authentication. If you disable or do not configure this policy setting, the WinRM client will use Digest authentication. Vulnerability: Digest authentication is less robust than other authentication methods available in WinRM, an attacker who is able to capture packets on the network where WinRM is running may be able to determine the credentials used for accessing remote hosts via WinRM. Counter Measure: Enable this policy setting. Potential Impact: If you enable this policy setting, the WinRM client will not use Digest authentication. If you disable or do not configure this policy setting, the WinRM client will use Digest authentication. Fix: (1) GPO: Computer ConfigurationAdministrative TemplatesWindows ComponentsWindows Remote Management (WinRM)WinRM ClientDisallow Digest authentication (2) REG: HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsWinRMClient!AllowDigest

[enable/disable]

(1) GPO: Computer Configuration\Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Client\Disallow Digest authentication (2) REG: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client!AllowDigest