Windows – WMI Remote “Access Denied”

remoteremote-accessSecuritywindowswmi

I can no longer remote access WMI on anything in my environment (10/8.1/XP/7 workstations). Here some specifics:

1) I am a Domain Admin and "MRT" is my user and password "mmmmn".

2) Since this happened I've been researching articles and have looked and verified the WMI and DCOM security settings were correct. I've tried changing the settings on several machines to see if anything would work with no success.

3) WBEMTEST works fine. I can connect locally and query anything I want. It does not work if I try it remotely. I recieve a "Number: 0x80070005 Access Denied" error.

4) I tested with "WMIC /node:172.16.98.12 /user:MRT /password:11111 computersystem get totalphysicalmemory" and got Access is denied response.

5) Scanned for virus' and malware and have turned up nothing.

Whats wrong? Obviously something changed in my environment is not respond for me.

Best Answer

Try psexec with your command "WMIC /node:172.16.98.12 /user:MRT /password:11111 computersystem get totalphysicalmemory" psexec \172.16.98.12 -u MRT -p 11111 wmic computersystem get totalphysicalmemory

Related Solutions

Windows – Useful Command-line Commands on Windows

A little known one is

getmac

It shows the MAC address(es) of your network adapter(s).

Screenshot of running getmac from a Windows commandline window.

Windows – Which permissions/rights does a user need to have WMI access on remote machines

The following works on Window 2003 R2 SP 2, Windows Server 2012 R2

Add the user(s) in question to the Performance Monitor Users group
Under Services and Applications, bring up the properties dialog of WMI Control (or run wmimgmt.msc). In the Security tab, highlight Root/CIMV2, click Security; add Performance Monitor Users and enable the options : Enable Account and Remote Enable
Run dcomcnfg. At Component Services > Computers > My Computer, in the COM security tab of the Properties dialog click "Edit Limits" for both Access Permissions and Launch and Activation Permissions. Add Performance Monitor Users and allow remote access, remote launch, and remote activation.
Select Windows Management Instrumentation under Component Services > Computers > My Computer > DCOM Config and give Remote Launch and Remote Activation privileges to Performance Monitor Users Group.

Notes:

As an alternatively to step 3 and 4, one can assign the user to the group Distributed COM Users (Tested on Windows Server 2012 R2)
If the user needs access to all the namespaces, you can set the settings in 2. at the Root level, and recurse the permissions to the sub-namespaces via the Advanced window in Security

Best Answer

Related Solutions

Windows – Useful Command-line Commands on Windows

Windows – Which permissions/rights does a user need to have WMI access on remote machines

Related Topic