Missing Classification Information

[victor21]

Hi All,

I am probably overlooking something here since I am just starting to learn the Discovery module.

I am trying to discover  a virtual Windows server built on VMWare and I am receiving the following errors in discovery log when I do quick discovery:

Missing Classification Information

Active, couldn't classify: No WMI connection, now finished

The payload from WMI:Classify probe is showing:

<?xml version="1.0" encoding="UTF-8"?><results probe_time="3120" result_code="0"><result><output>&lt;wmi&gt;&lt;Win32_OperatingSystem&gt;&lt;Caption&gt;Microsoft Windows Server 2008 R2 Standard&lt;
/Caption&gt;&lt;Version&gt;6.1.7600&lt;/Version&gt;&lt;/Win32_OperatingSystem&gt;&lt;Win32_ComputerSyst
em&gt;&lt;Domain&gt;WORKGROUP&lt;/Domain&gt;&lt;Name&gt;TUTORIAL01&lt;/Name&gt;&lt;/Win32_ComputerSystem&gt;&lt;Reg
istry&gt;&lt;entry key="HKEY_LOCAL_MACHINE"&gt;&lt;entry key="SYSTEM"&gt;&lt;entry key="CurrentCo
ntrolSet"&gt;&lt;entry key="Services"&gt;&lt;entry key="Tcpip"&gt;&lt;entry key="Parameters"&gt;&lt;ent
ry key="Hostname"&gt;&lt;value&gt;Tutorial01&lt;/value&gt;&lt;/entry&gt;&lt;/entry&gt;&lt;/entry&gt;&lt;/entry&gt;&lt;/en
try&gt;&lt;/entry&gt;&lt;/entry&gt;&lt;/Registry&gt;&lt;/wmi&gt;</output></result><parameters><parameter name="mid_selector_details" value="{&quot;mode&quot;:&quot;specific_mid&quot;}"/><parameter name="agent" value="mid.server.Tutorial01"/><parameter name="glide.xmlhelper.trim.enable" value="true"/><parameter name="use_class" value="discovery_classy_windows"/><parameter name="source" value="192.168.0.245"/><parameter name="WMI_FetchData" value="root\virtualization\v2\Msvm_ComputerSystem.Name,HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Tcpip/Parameters/Domain,HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Tcpip/Parameters/Hostname,root\MSCluster\MSCluster_Resource.PrivateProperties,root\MSCluster\MSCluster_Resource.Name,root\MSCluster\MSCluster_Node.Name,root\MSCluster\MSCluster_Cluster.Name,root\MSCluster\MSCluster_ClusterToResource.GroupComponent,root\MSCluster\MSCluster_ClusterToResource.PartComponent,root\MSCluster\MSCluster_ClusterToNode.Antecedent,root\MSCluster\MSCluster_ClusterToNode.Dependent,root\virtualization\Msvm_ComputerSystem.Name,root\MSCluster\MSCluster_Resource.Type,Win32_ComputerSystem.Domain,Win32_ComputerSystem.Name,Win32_OperatingSystem.Caption,Win32_OperatingSystem.Version"/><parameter name="port_probe" value="9802b18f0a0a0703009d322d5b5540e5"/><parameter name="sys_id" value="9c1f5874db3f73008a767b823996190a"/><parameter name="from_host" value=""/><parameter name="sys_created_on" value="2019-09-07 10:53:56"/><parameter name="sys_domain" value="global"/><parameter name="used_by_discovery" value="true"/><parameter name="state" value="ready"/><parameter name="probe_name" value="Windows - Classify"/><parameter name="discover" value="CIs"/><parameter name="response_to" value="6f0fd474db3f73008a767b82399619c6"/><parameter name="from_sys_id" value=""/><parameter name="priority" value="0"/><parameter name="agent_correlator" value="ee0f5c34db3f73008a767b823996194f"/><parameter name="probe" value="b11360600a0a0ba500c41bcbae55c5c4"/><parameter name="processed" value=""/><parameter name="error_string" value=""/><parameter name="sequence" value="16d0b5beb1d0000001"/><parameter name="port" value="135"/><parameter name="cidata" value="&lt;CIData&gt;&lt;data&gt;&lt;fld name=&quot;ip_address&quot;&gt;192.168.0.245&lt;/fld&gt;&lt;fld name=&quot;name&quot;&gt;tutorial01&lt;/fld&gt;&lt;fld name=&quot;os_domain&quot;&gt;WORKGROUP&lt;/fld&gt;&lt;/data&gt;&lt;/CIData&gt;"/><parameter name="name" value="WMI: Classify"/><parameter name="topic" value="WMIRunner"/><parameter name="queue" value="output"/><parameter name="ecc_queue" value="9c1f5874db3f73008a767b823996190a"/></parameters></results>

which seems to me contain all required information to register the CI.

Am I missing something here?

I have already gone through all post related to "Active, couldn't classify: No WMI connection" error.

Any thought?

Thanks and regards,

//Victor.

[richardbrounste]

The problem is one of 2 things:

1. Your Windows Credentials do not have local Admin rights for that machine

2. The ports that WMI needs between the MID Server and that Windows Server are closed.

To test WMI connections that Discovery needs, log into the MID Server and open a command prompt.  Run the following command replacing ip_address, domain\user and password with the correct parameters.  If you get a response, then you know the ports are open and the userid/password have the correct permissions.  If not, then it is almost certainly one of those 2 problems:

wmic /node:<ip_address> /user:<domain\user> /password:<password> path win32_operatingsystem

[victor21]

Thanks Richard.

I did as suggested and received error 'User credentials cannot be used for local connections' (whatever that means!). I will try to follow up on that, but don't you think the response from the probe suggests that the server was accessible?

Regards,

//Victor

PS:

When I run the command without credentials (wmic /node:<ip_address>  path win32_operatingsystem) then I receive response.

[victor21 · Accepted solution]

Hi,

I finally found answer to the problem. It turns out that this is not an access or authentication problem at all - rather due to incorrectly formatted response.

I applied SP1 to my Windows 2K8 server and upgraded Powershell version to 4; then I received a completely different response format and was able to complete the classification and other following steps.

Regards,

//Victor

[RAHUL Khanna1]

Hi , I am also facing the similar problem , can you help me out in resolving the issue