N-able N-central WMI based service is misconfigured

Last Modified

Mon Sep 28 15:53 GMT 2020

Description

  • This article helps you troubleshoot a misconfigured WMI based service. One of the following error messages appear:
    • For Type I - Permission Issues
  • 201 Access denied when connecting to : 192.168.1.9, Namespace = root\cimv2, UserName =
    • For Type II - Data is missing
  1. 102 Invalid class when process matrix 0 WQL = Select LDAPUDPoperationsPersec, LDAPActiveThreads, DRAInboundObjectUpdatesRemaininginPacket, LDAPClientSessions, LDAPWritesPersec, LDAPSuccessfulBindsPersec, DRAPendingReplicationSynchronizations, LDAPBindTime From Win32_PerfRawData_NTDS_NTDS
  2. 102 There is no information found for this WQL Query: Please check the parameters Select versionNumber, productUptoDate, ScriptExecutionTime, onAccessScanningEnabled, DisplayName From AntiVirusProduct

Environment

  • N-able N-central

Solution

The error messages reveal the reason for the misconfigured service. You can see the error message either by hovering over the Misconfigured symbol, or by clicking into the service itself.

Type I - Permission Issues

  • Most of the data N-able N-central can read out of WMI is published under root\cimv2. This type of error indicates that access was denied when the agent tried to connect to WMI. When the service is agent monitored, it is normal that this section does not have credentials. Local queries to the WMI do not require authentication.

Type II - Data is missing

  1. This error message indicates that the monitoring device associated to the service cannot find the data on which the service is designed to report. WMI is divided into classes, and the agent cannot find the class upon which the service should be reporting.
  2. This error message indicates that the data is missing from WMI. This message is specific to AV status service, which you can learn more about on AV Status Service is Misconfigured.

Type I - misconfigured WMI services

  • There are two basic resolutions for Permission-related Misconfigured WMI services
    1. The Probe is not using the correct credentials (not applicable for services being monitored by agent).
    2. The devices do not have the proper DCOM permissions set.
  • If the service is agent-monitored rather than probe monitored, the problem may relate to DCOM permissions. To ensure the DCOM permissions are set correctly set, follow these steps:
  • For Windows XP and later (including Windows Server)

Select Start then click on Run.

  1. Type DCOMCNFG and then click OK..
  2. Click No for any warning screens that appear, unless it is the User Access Control (UAC) prompt.
  3. Double-click Component Services.
  4. Double-click Computers.
  5. Click on My Computer > Properties. The My Computer Properties dialog opens.
  6. Select the COM Security (Default Security) tab.
  7. In the Access Permissions section, click Edit Default.
  8. Verify that sure that both "Self" and "System" are listed in the dialog with Local and Remote Access:
    1. Add the Probe's user account, if applicable. To add a user, click "Add..." and type in the missing user names (including domain name) and then click OK. You will need to set their permissions to both Local and Remote Access.
    2. Click OK to return to the COM Security Tab.
  9. In the Launch Permissions section, click Edit Limits.
  10. Verify that both "Anonymous Logon" and "Everyone" are listed in the dialog:
    1. Add the Probe's user account, if applicable. To add a user, click "Add..." and type in the missing user names (including domain name) and then click OK. You will need to set their permissions to both Local and Remote Access.
    2. Click OK to return to the COM Security Tab.
  11. Close the Component Services dialog.
  12. Select the Default Protocols tab.
  13. Verify that "Connection-Oriented TCP/IP" is at the top of the list.
    • Click the Move Up option if it is not.
    • Click Add and then Choose Connection-Oriented TCP/IP if it is missing.
  14. Remove any datagram protocols (UDP/IP, IPX, etc) with the permission of the customer.
  15. Click OK to exit the My Computer Properties window.
  16. Select Start and click Run.
  17. Type WMIMGMT.MSC and press Enter.
  18. Right-Click WMI Control (Local) and select Properties.
  19. Under the Security tab, expand the Root folder and select CIMV2. Click on the Security button.
  20. Verify that the Probe's and the Administrator's credentials are listed with Full Access.
  21. Repeat for the SecurityCenter folder.
  22. Click OK and exit out of the wmimgmt.msc console.

Type II misconfigured WMI services

  1. Check the service configuration to make sure it is looking where the Microsoft product will be publishing data:

    1. Click on the service.

    2. Change to the Service Details tab.

  2. Check for any drop downs or other means to reconfigure the service to look where Microsoft is publishing the data on this service or application.

  3. Use WBEMTEST to see if the data is being published to the location in WMI the service is checking:

    1. Click Start > Run and type in WBEMTEST.exe.

    2. Click the Connect button.

    3. In the Namespace enter: root\cimv2

      NOTE: if you are doing this from the probe and connecting to the device's WMI remotely, enter: \\IP ADDRESS\root\CIMV2

    4. Click Connect.

    5. Click the Enum classes button.

    6. Select the Recursive radio button and click OK.

    7. Scroll through the classes until you find the class you are monitoring. The specified class should be in the error message (for example, Win32_PerfRawData_MSExchangeIS_MSExchangeIS, Win32_Processor).

    8. Double-click on the class.

  4. If it is missing, try re-syncing the WMI repository. WMI Resync
  5. If the class still does not exist, contact Microsoft to see what else can be done to restore the missing class.