Active, couldn't classify: No WMI connection

anandtk
Giga Contributor

Getting this popular error in discovery.

Usually the issues would be around any of the following, not this time.

Already verified the following.

MID server and target (Windows7) are reachable.

Target TCP 135 , 139, 445, DCOM Ports: â—¦High port range 49152 - 65535
â—¦Low port range 1025 - 5000 All are kept open.

Account has :

Local admin right,

Domain wide account,

with password as never expire,

access to execute 'WMI queries' on the target servers.

I have personally used the discovery account to login to the server and ran a simple command on the command prompt and it works well.

Wondering what could be the next step.

WBEM test???

Please share your ideas.

1 ACCEPTED SOLUTION

Hi,



By the payload It's clear it's failing due to permissions. You may want to check your MID Server is running with the right account.



Connection failed to WMI service. Error: Permission denied


Thanks,
Berny


View solution in original post

17 REPLIES 17

anandtk
Giga Contributor

Without any one of you both, I could not have see a success. Thank gentlemen


Hello Team,



Discovery Credentials work with powershell query on machine but not over the network . we tried different IP's which work and dont work.



PS C:\Windows\system32> gwmi win32_computersystem -computer 149.59.172.254




Manufacturer : HP


Model : ProLiant DL365 G1


TotalPhysicalMemory : 4294651904





PS C:\Windows\system32> gwmi win32_computersystem -computer 149.59.153.117


gwmi : The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)


At line:1 char:1


+ gwmi win32_computersystem -computer 149.59.153.117


+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


      + CategoryInfo                   : InvalidOperation: (:) [Get-WmiObject], COMExcept


    ion


      + FullyQualifiedErrorId : GetWMICOMException,Microsoft.PowerShell.Commands


    .GetWmiObjectCommand




Need your inputs on same.


.


VPN
Kilo Contributor

I am facing similar issue..

I ran test credentials, it passed but when i ran quick discovery it gives below error.

Its a service account , able to discovery few devices for few devices i am facing this issue

<error>gwmi : Could not get objects from namespace root\default. Not foundAt C:\Servicesnow_Prod_Mid1\agent\scripts\PowerShell\WMIFetch.psm1:363char:20+             $reg = gwmi -list -computer $computer -credential $cred-namespace r ...+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo          : ObjectNotFound: (:) [Get-WmiObject], ManagementException+ FullyQualifiedErrorId : INVALID_NAMESPACE_IDENTIFIER,Microsoft.PowerShell.Commands.GetWmiObjectCommandYou cannot call a method on a null-valued expression.</error

Thanks & regards,

Vikas