User1 (No): User1 is a member of the Contoso\Administrators group (the domain's built-in Domain Local group). By default, only the Domain Admins global group is added to the local Administrators group of a member server (like Server2). The domain Administrators group is not added to member servers. Therefore, User1 is not a local administrator on Server2 and is not granted the necessary PSRemoting permissions (which require local Administrator or Remote Management User rights).

User2 (Yes): DC1 is a Domain Controller. On Windows Server 2012 and later, PowerShell Remoting (WinRM) is enabled by default on Domain Controllers. The default session configuration grants access to the BUILTIN\Administrators and BUILTIN\Remote Management Users groups. Since User2 is a member of Contoso\Remote Management Users, they are authorized to connect to DC1.

User3 (No): User3 is a member of the Power Users group on Server2. The Enable-PSRemoting cmdlet grants connection permissions to the Administrators and Remote Management Users groups. It does not grant permissions to the legacy Power Users group.

Microsoft Learn. Enable-PSRemoting. ("The Enable-PSRemoting cmdlet performs the following operations: ... Registers the Microsoft.PowerShell and Microsoft.PowerShell.Workflow session configurations ... sets the security descriptor... to allow access by members of the Administrators and Remote Management Users groups.")

Microsoft Learn. Default local groups. ("The Domain Admins group is added to the local Administrators group... The Administrators group in the domain is not added to the local Administrators group on member servers.")

Microsoft Learn. Installation and Configuration for Windows Remote Management. ("On server versions of Windows, the WinRM service is started automatically... Users in the local Administrators group can use the WinRM service... To allow other users... add the user to the Remote Management Users group.")