Yet another RPC problem

[rhapsody01]

Hi,


I'm trying Lansweep V4 since few days in our company.
I have to say that i found your product awesome and very efficient.

We've got around 2000 Workstations and 190 Servers.
I have an RPC issue on 546 Workstations. All the rest is working fine.

The error :

Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) FRL023016 (FRL023016.fr.****.net)    	10/08/2010 15:23:44
Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) FRL023016 (FRL023016)   	10/08/2010 15:23:44
Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) FRL023016 (10.128.29.104) 

My tests :
Nmap on host to see if ports are open (not filtered) :

PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
1761/tcp  open  landesk-rc
1762/tcp  open  landesk-rc
38292/tcp open  landesk-cba

Ports are open.

LanSweeper connection test with same credentials as those configured for LanSweeper service :

DNS test
-----------------------------------------------
Is this the correct remote IP: 10.128.29.104
If not, please check for DNS problems

Is this the correct computer name: FRL023016
If not, please check for DNS problems

Remote WMI test
-----------------------------------------------
Found: Microsoft Windows XP Professionnel Service Pack 3
\root\cimv2 Remote WMI access test OK

Remote Registry test using WMI
-----------------------------------------------
Found: Microsoft Windows XP Service Pack 3
\root\default Remote WMI access test OK

Tested WMI connection with another software :
"WMI Explorer" (Home Page)

I am able to connect, browse WMI Classes, and collect DATA.
Everything is working fine !

I have no clue, any idea ?

Thanks !

[rhapsody01]

Some Updates ...

In my previous post i wrote :

BUT, untick Checkpoint layer on network Lan interface properties, did the trick ! (You can still connect to VPN, but without software FW).
Now i just have to deploy this config to my clients.

Well after some research, i have to say that i was wrong. Untick this checkbox will make Secure Client VPN unstable.

So i went back to the beginning.
Then i found out that Microsoft has an knowledge article on this issue :
Here's the link

They have a workaround to enable RPC on Windows Servers to be able to communicate with client that are behind some Firewall.

This is working for me, without any change to my client's configuration.

Perhaps you should add this article to LanSweeper Troobleshooting guide ? 🙂

[rhapsody01]

Yes you're right.

Our laptop users have Checkpoint Secure Client installed.
Since the port 135 Tcp was open, i didn't pay attention to this.
Moreover, when disabling both Checkpoint services, the error was still there.

BUT, untick Checkpoint layer on network Lan interface properties, did the trick ! (You can still connect to VPN, but without software FW).
Now i just have to deploy this config to my clients.

I also found out that Wide cap (HomePage) was conflicting with RPC. When issuing a scan with LanSweeper, the client workstation will reboot ! (NT/System will reboot your computer in 30 sec). I had to remove Widecap. You can add it to conflicting software list 🙂

Thanks.

[Hemoco]

rhapsody01 wrote:
I also found out that Wide cap (HomePage) was conflicting with RPC. When issuing a scan with LanSweeper, the client workstation will reboot ! (NT/System will reboot your computer in 30 sec). I had to remove Widecap. You can add it to conflicting software list 🙂

NeoAccel software had the same problem and they have patched this bug in their latest release.

[rhapsody01]

Widows Firewall service is disable on our clients.
As you can see with the Nmap test port 135 is listening and open.

[Hemoco]

rhapsody01 wrote:
Widows Firewall service is disable on our clients.
As you can see with the Nmap test port 135 is listening and open.

Possibly third party firewall?
Please download http://www.runscanner.net/runscanner.exe and post a .run file of the computer.

[Hemoco]

Do you have any firewall/security software running on these clients?