Advanced Discovery Troubleshooting - WMI

[doug_schulze]

My friend in the BRK showed me this handy little way to help prove a WMI connection outside the midserver but using the same components asking the question. This can come in handy when you can't figure out why you are having problems connecting to a Windows OS and want to see the raw return before the "machine" starts processing it.

*As always be careful whenever stepping outside the controls of the UI, this process will have no more impact then a regular discovery but you want to be sure you have the necessary understanding of how scripting works, do this with an idle mid server application and the ability to understand the returns...have fun, this can be very helpful to prove where the problem lies...

1. RDP to Midserver host as the Midservers 'runs as' user
2. Open a command prompt and navigate to your midserver /agent folder
3. Create a script (test.js) with the necessary query you are trying to re-create, below is an example of a single command trying to pull back an Operating System value


var scanner = getScanner();
if (scanner) {
scanner.addFetch('Win32_OperatingSystem.Caption');
scanner.fetch();
}


4. After you save it, type and execute the line below

cscript lib\WMIRunner.js [IP of the target] test.js

5. Review results


Again, this can help with troubleshooting connecting to a machine for the first time or fixing a troublesome probe...Knowledge is power... enjoy

[dline]

Hey thanks for the great little script, I ran it and I get the following error:

Connection failed to WMI service. Error: Permission denied

Does this mean I have a permissions issue on my mid server to the WMI service or some kind of firewall issue possibly on the client?

[doug_schulze]

Most likely a Windows user permission issue.. ensure that the Windows user you are using is a domain user with local admin priv on the targets you are looking to discover!

[dline]

I am getting the same exact error as you, Connection failed to WMI service. Error: Permission denied.

Unfortunatley our environment is not within an AD, and I am running the Mid Server service using the same local admin credentials on the box I am attempting to discover. I've gotten this specific with our testing, one box.

This is as far as I've been able to get after discovering that it was local Windows firewall issues that were preventing Discovery form even identifying my desktop CIs, so I've turned off the firewall, and now am left with this next hurdle.

Any other suggestions as to what may be causing this issue? If I don't see something soon, I'm going to be less inclined to go around to 500+ boxes or script a solution to create a firewall exception that will still leave me with this issue to deal with.

[doug_schulze]

Are you trying to discovery 2008 R2 boxes, specifically with UAC enabled?..

If so then Microsoft took the local administrator remote access ability away unfortunately..

If not then as you have remove the FW issue (i might recommend a policy that allows any any from the midserver instead of just shutting it off) then ensure that wmi service is running and the wmi drivers are installed...

If so then use something like script-o-matic from Microsoft (from the midserver logged in as the midserver/hosts local user) to ensure its not ServiceNow, if that does not work then Id talk to your windows admins/microsoft for suggestions...