Discovery: A scan of a Windows server fails with an error in WMI. How to test the WMI connection from a Discovery Windows proxy to a target host?

Version 8
    Share This:

    This document contains official content from the BMC Software Knowledge Base. It is automatically updated when the knowledge article is modified.


    PRODUCT:

    BMC Discovery.


    COMPONENT:

    BMC Discovery 11.3


    APPLIES TO:

    BMC Discovery



    QUESTION:

     
       A scan of a Windows server fails with an error in WMI. How to test the WMI connection from a Discovery Windows proxy to a target host? 


    ANSWER:

     

    The most common cause of a Windows scan failure is that the required ports are blocked by a firewall. The first step is to review the port requirements ("Windows Ports used for discovery") in https://docs.bmc.com/docs/display/DISCO113/Discovery+communications.

    If additional troubleshooting is needed:

    Open a command prompt on the proxy server and execute the wmic command. Examples:

      
       
        
         
    • wmic /node:<ipaddress> /user:<domain\username> /password:<password> PATH Win32_PhysicalMemory
    •    
    • wmic /node:<ipaddress> /user:<domain\username> /password:<password> PATH Win32_ComputerSystem get Name
    •    
    • wmic /user:mydomain\someuser /password:somepassword /node:remotehost /output:"c:\win32_computersystem.csv" path win32_computersystem Get /All /format:csv
    •   
        

    To check if WMI can see the HBA info, use these commands

        
         
    • wmic /user:<login> /password:<login> /node:<ip> /Namespace:"\\root\WMI"  path  MSFC_FCAdapterHBAAttributes
    •    
    • wmic /user:<login> /password:<login> /node:<ip> /Namespace:"\\root\WMI"  path  MSFC_FibrePortHBAAttributes
    •   
        

    The same command can also be executed on the target host, for example:

        

               wmic PATH Win32_PhysicalMemory

        

    Tip: If the command works on the scanned host, but fails from the proxy, the root cause is in the network (typically a firewall, local or otherwise).               

        

    Problem#1: If the WMI service on the target host is stopped, there will be an error like:

        

    ERROR:
    Code = 0x80070422
    Description = The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    Facility = Win32

        

    Solution#1: Start the WMI service on the host affected by this issue

        


    Problem#2: If communication is blocked by a firewall, wmic can:
    - return an empty output (for example, if the ports dynamically allocated by WMI were closed)
    or
    - show the error below 

        

           ERROR:
           Code = 0x800706ba
           Description = The RPC server is unavailable.
           Facility = Win32 

        

    Solution#2: Open the required ports as documented in the section "WMI" in https://docs.bmc.com/docs/display/DISCO113/Discovery+communications

        


    Problem#3:  If NT AUTHORITY\SERVICE is not in Administrators Group or WMI components are corrupted:

        

    ERROR:
    Code = 0x800706b5
    Description = The interface is unknown.
    Facility = Win32

        

    Solution#3: Re-register WMI components and add NT AUTHORITY\SERVICE  to Administrators Group.

        


    Problem#4: The wmic command does not return any result (it's blocked, no error message, no prompt)

    Root cause 1 / Solution: A firewall (local or otherwise) is blocking communication. Make the appropriate changes to the firewall.
    Root cause 2 / Solution:  Password for the service account was expired. Reset the password.
    Root cause 3 / Solution:  Remote UAC is enabled.  See "UAC" in  https://docs.bmc.com/docs/display/DISCO113/User+privileges+and+information+access+for+Windows+operating+systems and also KA 000098399.

     
    Problem#5: If the error is "Failed to access Win32_NetworkAdapter : Failed to retrieve batch of results : 0x80041004 : Provider Failure" 
    Solution#5:  see KA 000143183.


    Problem#6: This error message can happen for various reasons: 

        

    ERROR:
    Code = 0x80070005
    Description = Access is denied.
    Facility = Win32 

        

    Root cause 1:  Incorrect domain and/or user and/or password.
    Solution 1:  Provide the correct login information.

    Root cause 2: UAC is enabled. It has to be disabled in certain cases (see "UAC" in   https://docs.bmc.com/docs/display/DISCO113/User+privileges+and+information+access+for+Windows+operating+systems)
    Solution 2:  Disable it. See KA 000098399.

        

    Root cause 3: The credential does not have the required permissions as documented here:
      https://docs.bmc.com/docs/display/DISCO113/Windows+proxy+permissions
      see "Setting DCOM permissions/Setting WMI permissions"
    Solution 3:  Provide the correct permissions.



    Problem#7: If wmic returns this (no error code) ...

        

    Node - <ipaddress>
    ERROR:
    Description = The remote procedure call failed

        

    Solution#7: Set the proxy logs to DEBUG mode and recreate the problem. Check the proxy debug logs to see if they contain a code number. In one case, this code was  

        

    Failed to retrieve batch of results : 0x800706be : The remote procedure call failed.

        

    One possible cause for the 0x800706be code is described here:
    https://kb.paessler.com/en/topic/31833-what-does-800706be:-the-remote-procedure-call-failed-mean
    extract:
    "this error may indicate that the RPC Service is not running on the target machine. Please have a look at this Microsoft KB Article for details. "
    In the Microsoft KB Article, the section "Troubleshooting RPC" could help to find the cause. If this is not sufficient, please contact your Windows SME. It may be necessary to contact Microsoft support to determine why wmic throws this error. They could have a KB article, a fix or a workaround. 



    Problem#8: Scan of a Windows 2012 server ends with NoAccess, and a credential test fails with "Remote Access via Windows Credential Proxy xxxxxxx failed". A wbemtest run from the proxy shows:...

        

    Number: 0x800706bf 
    Facility: Win32 
    Description: The remote procedure call failed and did not execute 

        

    Solution#8: For a possible explanation, see https://communities.bmc.com/thread/115508 


    Problem#9: Credential test fails with "Remote access failed", and wbemtest/WMIC tests succeed and return data.

    Solution#9: In one case it was found that under Manage > Credentials > Windows Proxies tab > Proxy > Actions >  Manage > Discovery Methods, the box for "WMI" was not selected. After selecting this box, credential tests and scans started working. 

    See also KA 000090338: Troubleshooting Windows WMI discovery failures



    Problem #10: In one case the error code was:

             Code = 0x80041003
             Description = Access denied

    Solution #10: The customer's system administration team ran this command on the Windows Proxy:


    winrm s winrm/config/client @{TrustedHosts="*"}

    This command is not completely understood by BMC Support, so this solution needs to be understood by the customer and may need to involve the customer's security team. 

        



       
      

     


    Article Number:

    000031966


    Article Type:

    FAQ/Procedural



      Looking for additional information?    Search BMC Support  or  Browse Knowledge Articles