Suddenly can't scan a server (RPC server issue)

[Dimensio]

I have discovered that I am unable to scan a Windows Server 2003 RC2 box that previously had scanned properly. I initially thought that there was a problem with the server when software that I had uninstalled still appeared in the software list, however upon deleting the entry manually I discovered that the list never updated because the system was never scanning properly.

I'm getting the "The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)" error.

I have confirmed that DCOM services are running (including the registry check).
I have confirmed that the RPC service is running.
I have confirmed that the WMI service is running.
The error occurs even if I completely disable the Windows firewall.
I have confirmed that DNS is correct via ping -a <ipaddress> and making sure that the result resolved to the same IP address. I have also checked for duplicate DNS entries, but none were found. For a time the domain name was not in the DNS suffix search order, but I have resolved that problem.
I can connect to the remote fileshare from the server on which Lansweeper runs. I can also connect to Computer Management on the problem machine remotely.

I do not know what would have changed recently on the server apart from regular Windows updates. The only possibility other than an issue with the server itself is an unexpected port change on the hardware firewall between where the box sits and the rest of my network; the server in question is in a "darkroom" with its own manual firewall that I do not control. I had to request firewall exceptions previously in order to scan the server in the past. Firewall settings were updated last weekend and I suppose that it is possible that global restrictions were put into place without anyone in that department considering the consequences.

Does anyone have a comprehensive list of ports needed by Lansweeper that I may test? Alternatively, are there possible causes that may not be related to the firewall?

[mnoonan]

Have any of you tried the microsoft tool called WMIdiag.exe or WMI Diagnostic Tool? You can run this tool on any machine and it will tell you what steps you need to take to successfully correct these issues. I've run it on any machine that I have RPC or WMI issues, and it identified the problem every time. It outputs the data to a .txt and .csv file that you can scan and read recommendations. Just an idea...

[Hemoco]

A quick google gave this result:

What ports does WMI use?
WMI uses DCOM to communicate

DCOM information from the Microsoft site...

Firewall and Registry Settings for DCOM

DCOM dynamically allocates one port per process. You need to decide how many ports you want to allocate to DCOM processes, which is equivalent to the number of simultaneous DCOM processes through the firewall. You must open all of the UDP and TCP ports corresponding to the port numbers you choose. You also need to open TCP/UDP 135, which is used for RPC End Point Mapping, among other things. In addition, you must edit the registry to tell DCOM which ports you reserved. You do this with the "HKEY_LOCAL_MACHINES \Software \Microsoft \Rpc \Internet" registry key, which you will probably have to create.

The following example tells DCOM to restrict its port range to 10 ports:

Named Value: Ports Type: REG_MULTI_SZ Setting: Range of port. Can be multiple lines such as: 3001-3010 135

Named Value: PortsInternetAvailable Type: REG_SZ Setting:"Y"

Named Value: UseInternetPorts Type: REG_SZ Setting: "Y"

These registry settings must be established in addition to all firewall settings.

[Dimensio]

No response I see, and I've still had no luck.

I did try the connection tester; the output was what I expected:

Ping test OK
-----------------------------------------------
Remote registry test OK
-----------------------------------------------
Remote WMI access test FAILED
The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
-----------------------------------------------
Remote \\advancets\c$ access test OK



Contrasted with any other given system in the department:

Ping test OK
-----------------------------------------------
Remote registry test OK
-----------------------------------------------
Remote WMI access test OK
-----------------------------------------------
Remote \\fairfax-019\c$ access test OK



This was done with the firewall service turned off.

As I said, the only major difference between the problem server and any normal workstation's configuration is the presence of a hardware firewall between the problem server and the inventory server. It is possible that IT (who controls the firewall) did something, but I want to rule out every other possibility before I go asking them to dig up their logs.