Troubleshooting Windows Services - WMI 201 or 205 errors

Last Modified

Mon Apr 06 15:47 GMT 2020

Description

  • This article will help you diagnose and resolve various WMI problems that may arise while monitoring services, performing asset discoveries and executing remote management tasks.

Environment

  •  N-able N-central

Solution

  • Identifying a WMI-related Problem
  • Sometimes when a service has turned to a Failed () or Misconfigured () state, it can be the result of a WMI permission issue. You can identify these by clicking on the service to display the Status page where an error similar to the following may be displayed:
  • Connection or permission based errors
  • 205 Access denied when connecting to : 192.168.1.10, Namespace = root\cimv2, UserName = NABLE\nableuser
  • 103 Unauthorized access when connect to Host = 192.168.1.10, Namespace = root\cimv2, UserName = NABLE\nableuser
  • 201 COMException caught when connect to Host = 192.168.1.10
    • The above errors are all indicative that you are having some sort of a WMI connection problem. The device that is connecting to your WMI is unable to establish a connection due to a permission missing or a failed authentication attempt.
  • Data or class related errors
    • 201 NAMatrixQueryProcessor::ProcessGeneralTypes: no instance is found. WQL: Select LoadPercentage from Win32_Processor where DeviceId="CPU1"
    • 102 Invalid class when process matrix 0 query = Select ActiveUserCount, RPCRequests From Win32_PerfRawData_MSExchangeIS_MSExchangeIS
      • The above errors are due to a missing WMI class or missing data within the class that is defined.
  • Understanding the Error Messages
  • Each of the aforementioned errors can be broken down into different sections that will help you narrow the issue down and help diagnose the problem. Here are two examples:
  1. 205 Access denied when connecting to : 192.168.1.10, Namespace = root\cimv2, UserName = NABLE\nableuser can be broken down into:
  • 205 Access denied when connecting to - The error message that is returned from the device that you are monitoring. In this case, it is telling us that we are failing authentication at the DCOM level.
  • 192.168.1.10 - The IP address that you are attempting to connect to. Verify that this is correct and if it's wrong, correct the IP within your N-able N-central UI.
  • Namespace = root\cimv2 - The WMI Namespace that the query is being run against. You'll need to know this if manually testing and connecting using WBEMTEST.exe
  • UserName = NABLE\nableuser - The credentials that the monitoring device is using to connect to the WMI. NOTE: If you are monitoring this task by local Agent, it is normal that this section does not have credentials. Local queries to the WMI do not require authentication.
  1. 102 Invalid class when process matrix 0 query = Select ActiveUserCount, RPCRequests From Win32_PerfRawData_MSExchangeIS_MSExchangeIS can be broken down into:
  • 102 Invalid class when process matrix 0 - The error message that is returned from the device that you are monitoring. In this case, it is telling us that the class (Win32_PerfRawData_MSExchangeIS_MSExchangeIS) does not exist.
  • query = Select ActiveUserCount, RPCRequests From Win32_PerfRawData_MSExchangeIS_MSExchangeIS - The query that is being run on the WMI. You can use this to manually test whether or not the Class is present.
  • Troubleshooting
  • Now that you have determined whether your issue is a Connection/permission based problem or one that involves the data within the WMI, we can narrow down the troubleshooting steps to resolve the problem.
  1. Permission-based Issues:
    • The problem is likely one of the two following scenarios:
    1. The Probe is not using the correct credentials (not applicable for services being monitored by agent).
    2. The device(s) don't have the proper DCOM permissions set.
  • If this does not work, the problem is likely on the device itself.
  • Perform these steps on the monitored device
  1. Select Start then click on Run.
  2. Type DCOMCNFG and click OK.
  3. Click No for any warning screens that appear unless it is the User Access Control (UAC) prompt.
  4. Double-click Component Services.
  5. Double-click Computers.
  6. Right-click on My Computer.
  7. Select Properties.
    The My Computer Properties dialog opens.
  8. Select the COM Security (Default Security) tab.
  9. In the Access Permissions section, click Edit Default.
  10. Make sure that both "Self" and "System" are listed in the dialog with Local and Remote Access.
  11. Add the Probe's user account, if applicable. To add a user, click "Add..." and type in the missing user names (including domain name) then click OK. You will need to set their permissions to both Local and Remote Access.
  12. Click OK to return to the COM Security Tab.
  13. In the Launch Permissions section, click Edit Limits.
  14. Make sure that both "Anonymous Logon" and "Everyone" are listed in the dialog.
  15. Add the Probe's user account, if applicable. To add a user, click "Add..." and type in the missing user names (including domain name) then click OK. You will need to set their permissions to both Local and Remote Access.
  16. Click OK to return to the COM Security Tab.
  17. Close the Component Services dialog.
  18. Select the Default Protocols tab.
  19. Verify that "Connection-Oriented TCP/IP" is at the top of the list. Click on the Move Up option if it isn't or click on Add and then Choose Connection-Oriented TCP/IP if it is missing.
  20. Remove any datagram protocols (UDP/IP, IPX, etc) with the permission of the customer.
  21. Click OK to exit the My Computer Properties window.
  22. Select Start and click Run.
  23. Type WMIMGMT.MSC and press Enter.
  24. Right-Click WMI Control (Local) and select Properties.
  25. Under the Security tab, expand the Root folder and select CIMV2. Click on the Security button.
  26. Ensure that the Probe's and the Administrator's credentials are listed with Full Access.
  27. Repeat for the SecurityCenter folder.
  28. Click OK and exit out of the WMIMGMT.MSC  console.
2. Data or Class-related Errors
  • Re-syncing the WMI Repository.
  • For Windows 2008 Servers:
    • winmgmt /salvagerepository
  • Testing the WMI manually using WBEMTEST.exe
  1. Click Start > Run and type in WBEMTEST.exe
  2. Click the "Connect" button.
  3. In the Namespace enter: root\cimv2 (NOTE: if you are doing this from the probe and connecting to the device's WMI remotely, you'll want to enter: \\IP ADDRESS\root\CIMV2)
  4. Click Connect.
  5. Click the Enum classes button.
  6. Select the Recursive radio button and click OK.
  7. Scroll through the classes until you find the class we are monitoring. The specified class should be in the error message (for example, Win32_PerfRawData_MSExchangeIS_MSExchangeIS, Win32_Processor).
  8. Double-click on the class. If it is missing, this could be the problem. Try Re-syncing the repository using the steps above and if the class still does not exist, you'll want to contact Microsoft to see what else can be done to restore the missing class.
  9. Click "Instances".
  • In here, there should be data showing various values that we typically use to monitor. If you have gotten this far and the issue persists, then take a screenshot or summarize the contents of this Window and open a case with our Technical Support team.