PowerShell CIM Cmdlets and WS-Management: Remote Authentication Fallback Behavior

CIM Session Authentication and WS-Man Interoperability

When integrating PowerShell with remote nodes using Get-CimInstance, the CimSession object manages the connection via the WS-Management (WS-Man) protocol. To maintain security during integration testing, it is necessary to define specific authentication options—such as Kerberos or NTLM—to avoid relying on production-level administrative credentials.

There is uncertainty regarding the Default session option's behavior when the target operating system version differs from the source. Specifically, the fallback mechanism for authentication protocols may vary, potentially impacting the ability to maintain constrained endpoints via PSSessionConfiguration for non-privileged accounts.

What is the deterministic order of authentication protocol fallback when the Authentication parameter is set to Default in a New-CimSession call? How does the target OS version influence this selection process during the WS-Man handshake?