WMI and Powershell access remote Windows machines on port 135 (RPC).
For remote Windows machines where Windows Firewall is enabled, it is not enough just opening port 135 to have Discovery successfully discover the machine.
When the MID server knocks at the door of RPC on the remote server via 135, the remote machine announces a (dynamic) port that the MID server has to use in order to access DCOM back on the remote server. The port announced by the RPC Server on the remote machine is one of a range of ports (unless RPC is configured to run with a static port).
The default ranges of DCOM ports are:
- from 1025 to 5000: Windows 2000, Windows XP and Windows Server 2003
- from 49152 to 65535: Windows Server 2008 and later versions, and in Windows Vista and later versions
If the range of DCOM ports is not opened in the Windows Firewall, Discovery will fail with the next error response to the "WMIRunner - WMI: Classify" probe:
<error>
Authentication failure with the local MID server service credential.
</error>
<error>
Failed to access target system. Please check credentials and firewall settings on the target system to ensure accessibility: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Stack Trace:
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementScope.InitializeGuts(Object o)
at System.Management.ManagementScope.Initialize()
at System.Management.ManagementObjectSearcher.Initialize()
at System.Management.ManagementObjectSearcher.Get()
at Microsoft.PowerShell.Commands.GetWmiObjectCommand.BeginProcessing()
at System.Management.Automation.Cmdlet.DoBeginProcessing()
at System.Management.Automation.CommandProcessorBase.DoBegin()
</error>
ServiceNow Wiki explicitly mentions that "Ensure that the MID Server application host machine has access to the targets on all ports due to the unique nature of the WMI requirements."
However, for customers that refuse to open all ports to the MID server there is a solution that consists on the next:
- A) Open the port 135 on the firewall.
- B) Open acces to the standard DCOM ports.
- C) Optionally, configure DCOM to use a specific range of ports instead of the standard DCOM ports, and open them on the firewall.
A) How to open the port 135 on the Windows Firewall (Windows 2000, XP, Server 2003):
This solution consists on adding an Exception to Windows Firewall. Follow the next steps:
- Start > Control Panel > Windows Firewall > Exceptions > Add Port...
~ Name: RPC Endpoint Mapper - TCP Port 135
~ Port: 135
~ TCP
A) How to open the port 135 on the Windows Firewall (Windows Server 2008, Vista and later):
This solution consists on adding a rule to Windows Firewall with Advanced Security to open the port 135/RPC. Follow the next steps:
- Start > Administrative Tools > Windows Firewall with Advanced Security
- Inbound Rules (right button click) >> New Rule...
- [Rule Type]: select "Custom", click "Next".
- [Program]: select "All programs".
- [Program]: on Services, click "Customize...". Select "Apply to this service: Remote Procedure Call (RPC) - RpcSs" and click "OK" to close the dialog box. Click "Next".
- [Protocol and Ports]: select "Protocol type: TCP".
- [Protocol and Ports]: select "Local port: RPC Endpoint Mapper".
- [Protocol and Ports]: leave "Report port: All Ports" and click "Next".
- [Scope]: leave "Which local/remote IP addresses does this rule match: Any IP address" (you might need to set it different for your security policy). Click "Next".
- [Action]: select "Allow the connection"
- [Profile]: select "Domain", "Private" and "Public" (you might need to set it different for your security policy). Click "Next".
- [Name]: give the rule a name: "RPC Endpoint Mapper - TCP Port 135". Click "Finish".
It is possible that other of the predefined rules already allows access to 135/RPC. That is the case of the rule "File and Printer Sharing - RPC-EPMAP".
Even so, it is still interesting having your own rule controling this access.
B) How to open access on the Windows Firewall to the standard DCOM ports (Windows 2000, XP, Server 2003):
This solution consists on adding Exceptions to Windows Firewall. As there are many exceptions to be added, we are going to run a script that adds the entries for you.
Follow the next steps:
- Make sure that the port 135 is open. For that, follow A)
- Open a command line and type the next:
FOR /L %I in (1025,1,5000) do netsh firewall add portopening TCP %I "Dcom - TCP Port "%I
That will add an entry per port to the Windows Firewall (3975 entries).
If you find that these are too many entries, you can follow the next steps in "C)" to have DCOM use only a few ports.
B) How to open access on the Windows Firewall to the standard DCOM ports (Windows Server 2008, Vista and later):
There are many ways to achieve this.
One of them is adding the Exceptions to Windows Firewall running the command of the previous section, but this time using the range of DCOM ports for Windows 2008. For that, substitute (1025,1,5000) in the command by (49152,1,65535).
That will add an entry per port to the Windows Firewall (16383 entries).
If you find that these are too many entries, you can follow the next steps in "C)" to have DCOM use only a few ports.
Other way consits on adding rules to Windows Firewall with Advanced Security as we saw in A). For that, follow the next steps:
- Make sure that the port 135 is open. For that, follow A).
- Start > Administrative Tools > Windows Firewall with Advanced Security
- Inbound Rules (right button click) >> New Rule...
- [Rule Type]: select "Custom", click "Next".
- [Program]: select "All programs".
- [Program]: on Services, click "Customize...". Select "Apply to all programs and services" and click "OK" to close the dialog box. Click "Next".
- [Protocol and Ports]: select "Protocol type: TCP".
- [Protocol and Ports]: select "Local port: Dynamic RPC".
- [Protocol and Ports]: leave "Report port: All Ports" and click "Next".
- [Scope]: leave "Which local/remote IP addresses does this rule match: Any IP address" (you might need to set it different for your security policy). Click "Next".
- [Action]: select "Allow the connection"
- [Profile]: select "Domain", "Private" and "Public" (you might need to set it different for your security policy). Click "Next".
- [Name]: give the rule a name: "DCOM - TCP Dynamic RPC". Click "Finish".
C) How to configure DCOM to use only a few ports.
We are going to add 100 ports: 65000 - 65100. Warning!: this is a really low value and would result in Discovery (and other remote applications) running too slow.
- Start > Administrative Tools > Component Services
- Console Root > Component Services > Computers > My Computer (right button click) >> Default Protocols > "Connection-oriented TCP/IP" > Properties...
- Add... Port range: 65000-65010.
- Restart the server.
- Follow the steps in B). For Windows 2000, XP, Server 2003 substitute (1025,1,5000) in the command by (65000,1,65100). That adds 100 entries to the Windows Firewall.
