question Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works in ITOM forum

Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

Bob D — Fri, 30 Aug 2019 16:39:06 GMT

I have several windows servers on a subnet. All but one are Discovered properly. One fails.

from Discovery logs:

Failed to access target system. Please check credentials and firewall settings on the target system to ensure accessibility: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

also

{"credential_type":"Windows","credential_name":"Windows","credential_order":"100","credential_success":false,"credential_id":"9e.....................b0ee"},

And finally - A credential test on this server fails to connect.

Has to be a credential issue, right? Or possibly network connectivity?

However -

Windows admins are able to establish remote PowerShell connection from the MID server using the Windows credential in question and run simple commands such as >dir c:\

I don't believe I have any options from the ServiceNow side to change any configuration or setting to address this. Suggestions on what could be the issue on the server side if the remote PowerShell from MID server is working?

thank you

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

Ian Mildon — Fri, 30 Aug 2019 16:50:14 GMT

Are you able to run the PowerShell connection with the failing credential from the MID Server? Also, can you make a successful Remote Desktop Connection to the server using the same credential?

If the credential is good, you should be able to do both.

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

chuckm — Fri, 30 Aug 2019 16:54:01 GMT

As Ian mentioned, if you are able to validate the credential using RDP then you know you have a good credential. RDP uses port 3389 which is a different port than ServiceNow Discovery uses.

Once you have a good credential, then I suggest you validate the ServiceNow Discovery WMI ports between the MID Server and the Remote Windows host are open (in the Windows Firewall and/or any firewall between the MID Server and the Windows host). ServiceNow Discovery uses WMI for discovery, therefore port 135 from the MID Server to the Remote Windows host must be open for initial communication AND high ports 49152 - 65535 must be open for the remainder of the communication. Even though this is a large range of open ports, only a portion of this range are dynamically allocated.

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

Bob D — Fri, 30 Aug 2019 18:42:17 GMT

Thanks guys -

Yes - Windows admins are able to establish remote PowerShell connection from the MID server using the Windows credential in question and run simple commands such as >dir c:\

Have not tried RDP...but would that tell me anything given the above connection is successful?

That's what makes this puzzling. What else is required if this test already works?

Port 135 is open, that's the only reason it's attempting the windows credential loging in the first place (for Windows Classify probe)

Port 5985 is open but 5986 is not (according to Shazaam input)

I'll check the high ports

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

Ian Mildon — Fri, 30 Aug 2019 18:49:58 GMT

If the Windows Admins are running the PowerShell with their credentials/logins, then it would work, even if the Credential entry for Windows fails. A lot comes down to the actual PowerShell script/commands they are sending and how the session is being established

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

chuckm — Fri, 30 Aug 2019 20:44:18 GMT

The error message "...0x80070005 (E_ACCESSDENIED)" typically can be one of 2 things: 1) a bad credential or 2) a blocked port(s). If you resolve #1 and #2, then most of the time discovery will be successful.

For the error message you are getting, I always troubleshoot 2 steps specifically in the following order:

Step 1 (Validate Credential using RDP)
Both remote PowerShell and RDP are both valid methods to test the credential. I always test credentials using RDP, but other community members have mentioned using remote PowerShell for testing credentials as well.

Step 2 (Check WMI port 135 and port ranges 49152 - 65535 are open)
Check the high ports - the Windows firewall might be blocking them. Discovery uses WMI which initiates on port 135 and the remaining communication occurs on high ports (49152 - 65535) for a successful discovery.

I suggest completing steps 1 and 2 before moving on to other troubleshooting.

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

Luiz Lucena — Fri, 30 Aug 2019 21:00:12 GMT

Have you confirmed if the credential you have for Discovery has local admin rights on the device to be discovered?

Also, another thing we did here was setup the MID Server service to logon with the credential the MID server will use on other devices.

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

doug_schulze — Fri, 30 Aug 2019 22:59:00 GMT

Is your credential record in the form of domain\user?

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

Bob D — Tue, 10 Sep 2019 14:35:49 GMT

Thanks Chuck. The Credential Test from within ServiceNow fails. But remote PowerShell execution directly from the MID server is successful (using the same credential, of course).

I've asked the server admin to check the high ports...but wouldn't the remote PowerShell connection from MID fail if that's the issue?

Also, question about your port diagram. Is the remote management port 5985/5986 not used? I thought it was.

thanks again

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

Shekhar Deshin1 — Tue, 10 Sep 2019 15:20:36 GMT

This error occurs if the server administrator does not have permissions to the local security policy on Microsoft Windows 2008 server.
1.You can verify the Local Security Policy on failing server.
2.The user does not have remote access to the computer through DCOM.
Typically, DCOM errors occur when connecting to a remote computer with a different operating system version.

Thanks

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

Bob D — Wed, 11 Sep 2019 18:50:33 GMT

Yes. That's what makes this frustrating. Several other windows servers on the same subnet are discovered OK with this same credential. I don't want to change anything with my ServiceNow or network config because it's working. To me - all evidence points to something on the server itself that is preventing a successful Discovery.

thank you, as always, Doug for your willingness to jump in

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

Brian Nielsen — Wed, 11 Sep 2019 20:15:53 GMT

Hi Bob D

It could very well be caused by WMI/RPC/firewall rules. The best source I could come up with in snap is this article from HI

"Resolving issue of RPC Server unavailable during Windows Server discovery in Service Mapping"
https://hi.service-now.com/kb_view.do?sysparm_article=KB0564282

Best regards Brian

Re: Discovery on windows server fails, credential test fails, but remote PowerShell from MID server works

chuckm — Thu, 12 Sep 2019 02:04:50 GMT

The reason why I don't use the Credential Test from within ServiceNow is that a failure does not indicate if it is a credential issue or port issue. Using RPC to test the credential from the MID Server can quickly determine if I have a valid credential - then I can move on to checking the ports.

I am not sure if the remote PowerShell uses high ports. RPC does use port 3389 and not the high ports.