Active, couldn't classify: No WMI connec

kirankumarv11
Mega Expert

Hello All,

When I am trying to discover windows server, I am getting below error:

Active, couldn't classify: No WMI connec

Can someone please help me to fix this issue. Below is the input payload

<results probe_time="48417" result_code="2">
<result>
<error>
Failure(s) with available Windows credentials from the instance.
</error>
<error>
The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
</error>
</result>
<parameters>
<parameter name="mid_selector_details" value="{"mode":"specific_mid"}"/>
<parameter name="agent" value="mid.server.AzureMidServer"/>
<parameter name="glide.xmlhelper.trim.enable" value="true"/>
<parameter name="use_class" value="discovery_classy_windows"/>
<parameter name="source" value="10.255.20.136"/>
<parameter name="WMI_FetchData"value="root\virtualization\v2\Msvm_ComputerSystem.Name,HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Tcpip/Parameters/Domain,HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Tcpip/Parameters/Hostname,root\MSCluster\MSCluster_Resource.PrivateProperties,root\MSCluster\MSCluster_Resource.Name,root\MSCluster\MSCluster_Node.Name,root\MSCluster\MSCluster_Cluster.Name,root\MSCluster\MSCluster_ClusterToResource.GroupComponent,root\MSCluster\MSCluster_ClusterToResource.PartComponent,root\MSCluster\MSCluster_ClusterToNode.Antecedent,root\MSCluster\MSCluster_ClusterToNode.Dependent,root\virtualization\Msvm_ComputerSystem.Name,root\MSCluster\MSCluster_Resource.Type,Win32_ComputerSystem.Domain,Win32_ComputerSystem.Name,Win32_OperatingSystem.Caption,Win32_OperatingSystem.Version"/>
<parameter name="port_probe" value="74cc4ca4972231002367955fda297589"/>
<parameter name="sys_id" value="bac4dcf2dbcbb7009c13f3de3b9619dd"/>
<parameter name="from_host" value=""/>
<parameter name="sys_created_on" value="2019-08-07 08:29:48"/>
<parameter name="sys_domain" value="global"/>
<parameter name="used_by_discovery" value="true"/>
<parameter name="state" value="ready"/>
<parameter name="probe_name" value="Windows - Classify"/>
<parameter name="discover" value="CIs"/>
<parameter name="response_to" value="a2c41036dbcbb7009c13f3de3b9619c1"/>
<parameter name="from_sys_id" value=""/>
<parameter name="priority" value="0"/>
<parameter name="agent_correlator" value="3fb41cf2dbcbb7009c13f3de3b961942"/>
<parameter name="probe" value="b11360600a0a0ba500c41bcbae55c5c4"/>
<parameter name="processed" value=""/>
<parameter name="error_string" value=""/>
<parameter name="sequence" value="16c6b32d3180000001"/>
<parameter name="port" value="5985"/>
<parameter name="cidata" value="<CIData><data><fld name="ip_address">10.255.20.136</fld></data></CIData>"/>
<parameter name="name" value="WMI: Classify"/>
<parameter name="topic" value="WMIRunner"/>
<parameter name="queue" value="output"/>
<parameter name="ecc_queue" value="bac4dcf2dbcbb7009c13f3de3b9619dd"/>
</parameters>
</results>
 
Regards
Kiran
1 ACCEPTED SOLUTION

kirankumarv11
Mega Expert

I have acheieved this with below changes:

  • Enabled file and printer settings to avoid RPC server Unavailable error
  • Created WMI firewall inbound rule

After these two changes in target ip, now I am able to discover successfully

Thanks!!

 

Regards

V Kiran Kumar

View solution in original post

8 REPLIES 8

vikrantsharma
Kilo Guru

If this is during the Classification Phase it has to be the credentials.

Have you tested the credentials, that you have stored in Service-now? I cannot see the credentials parameter in the payload.

Please make it correct or helpful if this solves or help you with your issue for other to make use it.

Thanks & Regards,
Vikrant Sharma

Hi Vikrant,

Thanks for your response!!

I have tested the credentials and results test connection fails.

Not sure, why credential paramenter is not available in payload.

 

Regards

V Kiran Kumar

The error message you are getting could be a credential issue or blocked port issue.  I would suggest 2 troubleshooting steps to help resolve this error.  First, validate the Credential using RDP and 2) check the WMI port 135 and port ranges 49152 - 65535 are open.

Step 1 (Validate Credential using RDP)

RDP from the MID server to the Remote Windows host to validate the Windows credential. This will validate the credential outside of ServiceNow discovery. This step only validates the credential - because RDP communicates on port 3389 to login to the Remote Windows host while ServiceNow Discovery uses a different range of ports for login and discovery communication.

find_real_file.png

Step 2 (Check WMI port 135 and port ranges 49152 - 65535 are open)

Validate the ServiceNow Discovery WMI ports between the MID Server and the Remote Windows host are open (in the Windows Firewall and/or any firewall between the MID Server and the Windows host). ServiceNow Discovery uses WMI for discovery, therefore port 135 from the MID Server to the Remote Windows host must be open for initial communication AND high ports 49152 - 65535 must be open for the remainder of the communication. Even though this is a large range of open ports, only a portion of this range are dynamically allocated.

find_real_file.png

If Steps 1 (validated credential) and 2 (validated WMI ports are open) have been completed successfully, then I suggest troubleshooting the Windows Host itself.

kirankumarv11
Mega Expert

I have acheieved this with below changes:

  • Enabled file and printer settings to avoid RPC server Unavailable error
  • Created WMI firewall inbound rule

After these two changes in target ip, now I am able to discover successfully

Thanks!!

 

Regards

V Kiran Kumar