3 Replies Latest reply on Mar 14, 2014 3:10 PM by VM Solutions

    Remote WMI - Access Denied

    forawsum

      I have been working to turn on an event log monitor and service monitor for the past few days. I noticed when I would test it would fail the test. After some troubleshooting I found that I can not even make a remote WMI call from any workstation or other server to this server.

       

      PS H:\> gwmi -ComputerName myserver -class win32_computersystem

      gwmi : Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

      At line:1 char:1

      + gwmi -ComputerName myserver -class win32_computersystem

      + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

          + CategoryInfo          : NotSpecified: (:) [Get-WmiObject], UnauthorizedAccessException

          + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

       

      . I downloaded and ran WMIDiag from Micrsoft and it detected some issues that I

      I did the two suggested fixes and it now says that WMI is configured properly. However, I still cannot connect remotely. I am running as a domain admin account and verified that domain admins are in the local administrators group. I have even tried explicitly adding the username to the ACL with full permissions.

       

       

       

       

      have remote enabled available on the WMI configuration at the root level.

      Capture2.JPG

      Capture2.JPG

       

      Any ideas?

        • Re: Remote WMI - Access Denied
          JaroslawLadyga

          Hi,

           

          I have the same problem. Server - I'd like to monitor Event Log - is in DMZ what should not be a problem (all firewall settings got checked while all ports opened).

          There are lot of below error messages on Event log of DMZ server:

          "Login failed for user 'dmz\adminServiceUser'. Reason: Attempting to use an NT account name with SQL Server Authentication. [CLIENT: xx.xx.xx.xx]"

          [CLIENT: xx.xx.xx.xx] is Orion server IP.

          User 'dmz\adminServiceUser' has full admin access to DMZ server.

           

          In the same time I have more monitors for services and performance counters on the same server. The only problem was with WMI as Fetching Method, I must use RPC to monitor services. But there is no choice if to use monitor for Event Log.

          I'm pretty close to suspect bug in Credentials relaying of Orion SAM.

          • Re: Remote WMI - Access Denied
            dd8900

            I thought I would bump this thread as I have the same issue.  Has anyone in the SolarWinds community successfully created a Windows PowerShell Monitor that uses Get-WmiObject?

             

            EDIT: Never mind.  I answered my own question.  For anyone else who finds this thread, adding -Credential ${CREDENTIAL} resolved my issue.

            • Re: Remote WMI - Access Denied
              VM Solutions

              forawsum Verify the 'Everyone' group does not include a 'deny' access entry. If it does, remove it and you should be able to perform remote WMI calls.