Archived community.zenoss.org | full text search
Skip navigation
Up to Discussions in zenoss-users
5215 Views 6 Replies Latest reply: Sep 27, 2011 10:56 AM by stevez RSS
stevez Rank: Green Belt
stevez
131 posts since
Aug 12, 2010
Currently Being Moderated

Sep 26, 2011 10:40 AM

WMIC/WMI Datasource against Domain Controller

I have problems querying WMI against domain controller in multiple domains. My account used for queries is in the DomainAdmins group (wanted to eliminate all group issues). Windows firewall is not enabled. Network is wide open between Zenoss and the server. All of the member servers of the domain respond fine to wmic. User/Pass are correct (not an access denied)

 

It looks like it has something to do with not being able to open pipes on a domain controller:

 

 

[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c00000b5) in dcerpc_pipe_connect_b_recv

[librpc/rpc/dcerpc_connect.c:329:dcerpc_pipe_connect_ncacn_ip_tcp_recv()] failed NT status (c00000b5) in dcerpc_pipe_connect_ncacn_ip_tcp_recv

[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c00000b5) in dcerpc_pipe_connect_b_recv

[wmi/wmic.c:196:main()] ERROR: Login to remote object.

NTSTATUS: NT code 0xc002001b - NT code 0xc002001b

 

Again this is on more than one domain. Has anyone experienced this? Other posts have indicated firewall but that isn't the case here.

 

Tags: wmi, domain, wmic, controller
  • dpetzel Rank: Brown Belt
    dpetzel
    1,141 posts since
    Oct 17, 2010
    Currently Being Moderated
    1. Sep 27, 2011 9:02 AM (in response to stevez)
    Re: WMIC/WMI Datasource against Domain Controller

    Stevez, Are you able to use wbemtest either locally, or from another windows machine to invoke a WMI query? Something like 'SELECT LastBootUpTime FROM Win32_OperatingSystem' should be a sufficient test.

  • stevez Rank: Green Belt
    stevez
    131 posts since
    Aug 12, 2010
    Currently Being Moderated
    2. Sep 27, 2011 9:23 AM (in response to dpetzel)
    Re: WMIC/WMI Datasource against Domain Controller

    Hi dpetzl,

     

    I went on the domain controller and ran wbemtest. It ran and I clicked connect. It connected without any credentials with a namespace of root\default. I then clicked the Query... button which gave me a dialog box for a WQL statement. I entered the one you suggested and got Invalid class. I also tried with a * as seen below. I'm not too familiar with WMI. The query looks fine, does this suggest anything to you?

     

     

    Edit: didn't allow my image through.

     

    query was   "select * from Win32_OperatingSystem"

     

    Result was

     

    Number:0x80041010

    Facility: WMI

    Description: Invalid Class

  • dpetzel Rank: Brown Belt
    dpetzel
    1,141 posts since
    Oct 17, 2010
    Currently Being Moderated
    3. Sep 27, 2011 10:35 AM (in response to stevez)
    Re: WMIC/WMI Datasource against Domain Controller

    It does tend to suggest WMI is not working properly and may not be a Zenoss/wmic issue. Can you do the following:

    1) Run the same test locally on one of your member servers that are not having the WMIC issue. Does that query work there?

    2) Is this a Windows 2008 Server? If so can you try running wbemtest as Administrator (right click --> run as administrator)

  • stevez Rank: Green Belt
    stevez
    131 posts since
    Aug 12, 2010
    Currently Being Moderated
    4. Sep 27, 2011 10:45 AM (in response to dpetzel)
    Re: WMIC/WMI Datasource against Domain Controller

    1) Fails on a member server as well. Wmic/Zenoss zenpacks work against this member server. Seems wbemtest isn't a good one for me - atleast not as configured.

     

    2) server 2003

     

    Curious

  • dpetzel Rank: Brown Belt
    dpetzel
    1,141 posts since
    Oct 17, 2010
    Currently Being Moderated
    5. Sep 27, 2011 10:47 AM (in response to stevez)
    Re: WMIC/WMI Datasource against Domain Controller

    Can you try replacing 'default\root' in the namespace field when you connect with "root\cimv2" and run those tests again? Sorry for not catching the name space difference earlier.

  • stevez Rank: Green Belt
    stevez
    131 posts since
    Aug 12, 2010
    Currently Being Moderated
    6. Sep 27, 2011 10:56 AM (in response to dpetzel)
    Re: WMIC/WMI Datasource against Domain Controller

    Ok replaced namespace to root\cimv2 and wbemtest worked on both DC and member server. My fault, again not a wmi guy and saw the root - was thinking it defaulted to the top of the tree.

     

    So wbemtest is working on both. My firewall guys swore up and down all the ports were open but they were not. Just confirmed.

     

    Thanks dpetzel I owe you one.

More Like This

  • Retrieving data ...

Legend

  • Correct Answers - 4 points
  • Helpful Answers - 2 points