Getting performance counter errors

performance-counterspstoolsremote-accesswindows-xp

I am trying to write C# code to access a computer (XP sp2) remotely to find out if a process is running. I don't know much about performance counters other than what I've been reading in the past couple of days, but here is my problem:

For troubleshooting, when I use psList (pslist \\target -u user -p pass) to access the target computer, I get this error:

Cannot connect to remote registry on <computer>
Access is denied.
Failed to take process snapshot on <computer>
Make sure that Remote Registy service is running on the remote system, that you have firewall ports allow RPC access, and your account has read access the following key on the remote system: HKLM\Software\Microsoft\Windows NT\CurrentVersion\perflib

When I use psList as administrator I get the same error except it says The network path was not found rather than Access is denied. I get this whether I "Run as administrator" in my normal account or if I actually sign into my administrator account and run the command from there.

Remote registry is running on the target computer.

When I use sc query (sc \\target query) as administrator I get this error:

[SC] OpenSCManager FAILED 5:
 Access is Denied

When this part of my C# code runs, Process[] targetProcess = Process.GetProcessesByName(string process, string ip); (I use an ip address here as my string, not a computer name), I get this wordy error:

System.InvalidOperationException: Couldn't connect to remote machine. —> System.InvalidOperationException: Couldn't get process information from performance counter. —> System.ComponentModel.Win32Exception: The network path was not found
at System.Diagnostics.PerformanceMonitor.Init()
at System.Diagnostics.PerformanceCounterLib.GetPerformanceData(String item)
at System.Diagnostics.NtProcessManager.GetProcessInfos(PerformanceCounterLib library)
— End of inner exception stack trace —

at System.Diagnostics.NtProcessManager.GetProcessInfos(PerformanceCounterLib library)
at System.Diagnostics.NtProcessManager.GetProcessInfos(String machineName, Boolean isRemoteMachine)
— End of inner exception stack trace —

at System.Diagnostics.NtProcessManager.GetProcessInfos(String machineName, Boolean isRemoteMachine)
at System.Diagnostics.ProcessManager.GetProcessInfos(String machineName)
at System.Diagnostics.Process.GetProcesses(String machineName)
at System.Diagnostics.Process.GetProcessesByName(String processName, String machineName)
at (methodname) in c:(pathname):line 132

  • File and printer sharing are on
  • Admin$ share is enabled
  • A network monitoring service used by my company (which I can't rely on because of wi-fi issues, thus I'm writing code) is able to access the processes on the target computer and tell me if they are running or not. So I know they are accessible.
  • I've done some reading on FAILED 5 to no result
  • I've gone through this from Microsoft (about troubleshooting registry keys that work with remote access)
  • I've gone through this from Microsoft as well. (similar to above)
  • I read most of this from Microsoft about working with performance counters
  • I've looked at things in Perfmon and they seem to be doing well (there are items in the drop-down list that every troubleshooter directs you to, rather than numbers or a blank)
  • I've looked through a few other questions and ideas that I've lost track of

From my limited knowledge, it seems that the performance counters are working fine, but I am still getting these errors suggesting that they are the problem. Why am I getting these errors?

Best Answer

Considering how easy this answer ended up being, I feel a bit dumb about it. I've been struggling with this and similar problems to it for weeks. A co-worker found out and happened to already have the answer in both batch and C#.

It turns out it was a permissions problem and not about performance counters. Which answered most of my question. This command solved the sc query problem:

NET USE \\target\IPC$ /u:user pass

I was unaware of the IPC$ share. After plugging that in I could freely use sc query, query process, and other remote commands on the target. Interestingly though I still could not use psList. I didn't need it though so didn't look into it.

The C# code was long - I'll put it on here when I have the code on me. Basically, all it did was create a Process object and plugged in that piece of command line code above. After that I could run the rest of my C# code to get the running processes from the target.

Related Topic