Why does an operator prefer WMI or a WS-Man shell over creating a service on the ADMIN$ share to run code on a target?

## Same goal, different cost on the target All of these channels run code on a remote host with a valid admin credential. What separates them is **how much the operator has to construct on the destination**, and that cost is what an experienced operator optimises. ## What service creation over the admin share costs To run code by creating a service, the operator typically: 1. Writes an executable to the target — for example copying it to a path under the administrative share. 2. Registers a **new service** that points at that executable. 3. Starts the service so the code runs. That is a file placed on the target's disk plus a newly created service. Both persist until removed, and both are things that did not exist on the host a moment earlier. It works, but it leaves the operator with more to build and more to clean up. ## What WMI and WS-Man cost instead WMI and a WS-Man remote shell reach a **management service that is already running and listening** on the host. The operator invokes an existing capability rather than installing one: no new service to register, and often nothing written to disk because the payload can be run in memory. That means fewer round trips and a smaller footprint on the target for the same result. The general principle is: **reuse what operations already runs.** The estate keeps these management services listening precisely so administrators can drive them remotely — which is exactly why they are attractive to an intruder holding the right credential. ## Already-listening changes effort, not authority A crucial qualifier: choosing an already-listening channel lowers the operator's *effort and footprint*, not the *authorisation bar*. WMI and a WS-Man shell still require: - **Administrative authority on the destination host** — the credential must be privileged on the target. - **Network reachability to the listening service's port** — the management endpoint must be reachable from the source. So 'already listening' is not 'no permission needed'. It means the operator does not have to create the mechanism, only to authenticate to one that is already there. ## Why interviewers ask it The wrong instinct is that dropping and running your own service is stealthier or more reliable than using a built-in one. In practice it is the opposite: writing a binary and registering a service is more to do and more to remove, while a running management service lets code execute with nothing new stood up. Understanding this is understanding why operators gravitate to WMI and WS-Man over service creation when they have the choice.