RPC and WMI Errors are Driving Me Craaaazzzyyyy!

[wmjstu]

I've been through every darn post on this forum dealing with RPC and WMI errors, and I've tried the whole schmear of resolutions.

About 3/4 of the machines on my network are failing to scan, and returning:

Wmierror The RPC server is unavailable 0x800706BA
Wmierror Cannot connect to DCOM port 135 : Firewalled?

No 3rd party firewalls, Windows firewall has port 135 open. Have even tried shutting it off.

We have Symantec Endpoint Protection, only AV installed. This has caused problems with other network applications in the past, so we have tried opening an exception, shutting off SEP, and even uninstalling it. No luck there.

Here are two flavors of typical Error Log entry:

4/29/2009 1:17:29 PM: 211AW0511 The remote procedure call failed. (Exception from HRESULT: 0x800706BE)
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()
at LansweeperService.MdlWmi.GetWMI(String Querystr, String Table, LS_Computer& mycomputer, String section, SqlConnection& sqlcon)

5/5/2009 10:00:12 AM: RM138AL0309 Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementObjectSearcher.Get()
at LansweeperService.MdlWmi.GetWMI(String Querystr, String Table, LS_Computer& mycomputer, String section, SqlConnection& sqlcon)

Have tried putting in lsclient and firing off manually; that doesn't seem to help.

Can't seem to find any pattern to the ones that DO scan, and a lot of them are returning the above errors, but show all of their info anyway.

I'm very confused. Any ideas??

Thanks,

Bill Stewart

IT Support, Buist Moore Smythe McGee P.A.
wstewart@buistmoore.com
843-720-4670

[wmjstu]

OK -

When I disable SEP, it appears to work:

Remote WMI test
-----------------------------------------------
Found: Microsoft Windows XP Professional Service Pack 2
\root\cimv2 Remote WMI access test OK

Remote Registry test using WMI
-----------------------------------------------
Found: Microsoft Windows XP Service Pack 2
\root\default Remote WMI access test OK

And when I re-enable it, it still works . . . huh?

[wmjstu]

SEP has a firwalkl available, but we have not installed it.

Even so, it has still blocked some network applications. It's a pain in the butt to set up for Microsoft Active Sync, for example.

[Hemoco]

wmjstu wrote:
SEP has a firwalkl available, but we have not installed it.

Even so, it has still blocked some network applications. It's a pain in the butt to set up for Microsoft Active Sync, for example.

Could you try disabling the service and try the connectiontester.

[Hemoco]

When configured correctly the "netsh show state" should show:
Remote admin mode = enable

Does the "Symantec Endpoint Protection" have a build in firewall? Have you tried disabling it.

[wmjstu]

I'm running through the Access Denied procedure on my test machine again.

netsh firewall show state shows 135 <null>; when firewall disabled, it shows that.

Had any problems with the Symantec Endpoint Protection?

[Hemoco]

Can only be 2 things:

1) the computer isn't configured correctly, see http://www.lansweeper.com/kb/accessdenied.aspx (maybe try to repair WMI with point 6)

2) if you are very sure that 1 is correct then it must be a firewall (windows build-in or other)
Did you try a "netsh firewall show state" on this computer?

[wmjstu]

That gives me:

Could not open connect to the host on port 135; Connect failed

[Hemoco]

try "Telnet 10.128.2.66 135"

without the ":"

[wmjstu]

I entered:

Telnet 10.128.2.66:135

Is this incorrect?