Windows 10 WMI and Event Viewer access denied

windows 10wmi

We have a Windows domain where I used GPOs to enable remote management and monitoring of all of our workstations using WMI. I can also connect to all of our computers with Computer Management and start and stop services and look at event logs, etc. All of that works great.

Except:

We have one computer that was running Windows 8.1 Pro and all of the above remote management, etc. was working; and then we ugpraded it to Windows 10 Pro for testing. It seems like all GPOs have applied to Windows 10 also, but WMI is not accessible remotely, and (maybe related, maybe not) if I connect (successfully) with Computer Management, I can access all the usual things except the Event Viewer (and WMI security settings).

I've re-run winrm quickconfig, I've checked and allowed DCOM permissions and WMI permissions, and then re-started the WMI service, and I still can't connect to WMI remotely. Web searches for any Windows 10 problems are still not turning up good results, in general, and nothing for this problem that I've found.

Has anyone gotten remote access to WMI to work on a Windows 10 computer? If so, how?

Addenda:

  • WinRM service is set to automatic and is running.
  • Windows Firewall is disabled. Windows Firewall services is stopped and disabled.

Best Answer

have you tried the following:

  • Checked a local wmi query to make sure there is not corruptions or anything from the local side?
  • Checked with procmon to see if there are any access denied messages on the remote machine or on the initiator side machine?
  • Make sure with gpresult or rsop that all the gpos you are using to set the permissions actually apply.

In general i haven't seen this problem in our environment, but it sounds like a local corruption in wmi or a permissions that aren't set on the client side.

shachaf

Related Topic