Document the WinRM prerequisites on the targeted host

README.md

@@ -28,6 +28,31 @@ The Windows Remote Management (WinRM) Java Client is a library that enables to:
 >   (and `WinRMWqlExecutor` copies the lists passed to its constructor): callers that mutated
 >   the returned collections must now copy them first.
 
+## Prerequisites on the target host
+
+WinRM must be enabled on the targeted Windows host, and the account must have sufficient privileges:
+
+* **Windows Server 2012 and later** have WinRM enabled by default — service running, HTTP listener
+  on port **5985**, firewall open, `Negotiate` and `Kerberos` authentication enabled. An
+  administrator account works with no host-side configuration.
+* **Windows 10 / 11** (and other client editions) do **not**: run `winrm quickconfig` or
+  `Enable-PSRemoting -Force` from an elevated prompt. Being domain-joined does not enable WinRM —
+  being a *Server* edition does.
+* **Privileges**: domain administrators, any domain account in the host's local `Administrators`,
+  and the built-in local `Administrator` work as-is. **Other local administrator accounts are
+  denied** by UAC remote token filtering unless `LocalAccountTokenFilterPolicy` is set to 1.
+  Non-administrator accounts need an explicit grant on the WinRM listener (`RootSDDL`), plus — only
+  if they run WQL queries — WMI grants (`WinRMRemoteWMIUsers__` and namespace rights). An account
+  that only runs commands never reaches WMI and needs nothing there.
+* `AllowUnencrypted`, `Basic`, `CredSSP` and `TrustedHosts` do **not** need to be changed: over
+  plain HTTP the payload is protected by NTLM message encryption, and `TrustedHosts` is a
+  Windows-client setting that a Java client never reads.
+
+The full prerequisites — enabling WinRM over HTTP or HTTPS, Group Policy, firewall rules, the
+privileges each operation requires, configuring a non-administrator account, host quotas, and a
+symptom-to-cause troubleshooting table — are documented on the
+[Preparing the Windows Host](https://metricshub.org/winrm-java/preparing-the-host.html) page.
+
 ## Quick start
 
 The fluent `WinRMClient` is the entry point of the library: one client authenticates once and can

src/site/markdown/authentication.md

@@ -127,5 +127,7 @@ or when the KDC is not a fully qualified DNS name.
 
 ## See also
 
+* [Preparing the Windows Host](preparing-the-host.html) — the privileges the account needs, and why
+  local administrator accounts are often denied
 * [TLS / HTTPS](tls.html) — required for Kerberos and recommended for NTLM
 * [Timeouts and Errors](timeouts-and-errors.html) — how authentication failures surface

src/site/markdown/file-transfers.md

@@ -170,3 +170,11 @@ Notes:
 * **Integrity**: every path through the transfer ends with a digest verification of the actual
   destination; the digest is a transfer-integrity check (the channel itself is authenticated and,
   over HTTP, encrypted).
+* **Host requirements**: the account must be able to run remote commands and to write to the
+  destination directory, and the host must provide `certutil` (transfer) and `forfiles`
+  (housekeeping). See [Preparing the Windows Host](preparing-the-host.html).
+
+## See also
+
+* [Remote Commands](commands.html) — the command builder that carries the transfer
+* [Preparing the Windows Host](preparing-the-host.html) — the privileges a transfer needs

src/site/markdown/index.md

@@ -60,6 +60,13 @@ command-line jar.
 
 ## A first WQL query
 
+> [!NOTE]
+> **On the target host**, WinRM must be enabled and the account must have sufficient privileges.
+> Windows Server 2012 and later have WinRM enabled by default and an administrator account works
+> with no configuration; Windows 10 / 11, non-administrator accounts, and local (non-domain)
+> administrator accounts all need host-side setup. See
+> [Preparing the Windows Host](preparing-the-host.html).
+
 Everything starts with the fluent
 [`WinRMClient`](apidocs/org/metricshub/winrm/WinRMClient.html) builder — one client authenticates
 once and can run any number of queries and commands over the same connection:
@@ -106,6 +113,8 @@ remain available and unchanged, with their checked exceptions.
 ## Where to go next
 
 * [Installation](installation.html) — coordinates, supported JDKs, and the standalone CLI jar
+* [Preparing the Windows Host](preparing-the-host.html) — prerequisites on the target: enabling WinRM
+  and the privileges the account needs
 * [WQL Queries](wql.html) — query WMI and read the result
 * [Remote Commands](commands.html) — run commands and copy files to the host
 * [File Transfers](file-transfers.html) — how files are copied through the WinRM channel

src/site/markdown/installation.md

@@ -66,6 +66,7 @@ Subcommands, options, password handling, streaming behavior, and exit codes are
 
 ## Where to go next
 
+* [Preparing the Windows Host](preparing-the-host.html) — enabling WinRM and the required privileges
 * [WQL Queries](wql.html)
 * [Remote Commands](commands.html)
 * [Command-Line Client](cli.html)