WMI Error Output: ERROR: Login to remote object.

[mcapra]

It's probably worth following the steps in the documentation to create a local account, just for the sake of troubleshooting. If that works, we've at least isolated the problem to the specific domain account which is much stronger footing than where we are currently.

This plugin does support domain authentication -- I've done it many times with many different setups. However, the documentation provided pretty plainly has the user starting with a local account first.

[scottwilkerson]

It's probably worth following the steps in the documentation to create a local account, just for the sake of troubleshooting. If that works, we've at least isolated the problem to the specific domain account which is much stronger footing than where we are currently.

Agreed

[mamir]

Hello Support,

I have tried a local administrator account as well, no luck. I user in such format from the configuration wizard: hostname/user & the password.

Also, since the machine is on the domain, enter the domain name in the domain field, still same exact error message, please assist, can I share you

my screen, so we take look together will make it easier. Because this machine doesn't have any GPO associated with, & this is a brand new Windows

2012 R2, im using for testing the WMI, I tried on different machines same thing. I wonder if there is something broken in the Nagios Xi itself, is

there way to check/confirm.

[scottwilkerson]

Can I have you attempt a "raw query" ad described in this article
https://support.nagios.com/kb/article/n ... g-579.html

[mamir]

When I run the following command with the SSH session to my nagios xi, with in my ownipaddress, I used my own nagios xi IP address
/usr/local/nagios/libexec/check_wmi_plus.pl -H myownipaddress -u wmiagent -p wmiagent -m checkcpu -d

I get the below results? Please, take a look. whats going on here.

Command Line (v1.6): /usr/local/nagios/libexec/check_wmi_plus.pl -H myownipaddress -u USER -p PASS -m checkcpu -d
Base Dir: /usr/local/nagios/libexec
Conf File Dir: /usr/local/nagios/libexec
Loaded Conf File /usr/local/nagios/libexec/check_wmi_plus.conf
Starting Keep State Mode
STATE FILE: /tmp/cwpss_checkcpu__10250132___.state
Round #1 of 1
QUERY: /usr/bin/wmic '-U' 'USER%PASS' '--namespace' 'root/cimv2' '//myownipaddress' 'select PercentProcessorTime,Timestamp_Sys100NS from Win32_PerfRawData_PerfOS_Processor where Name="_Total"'
OUTPUT: [librpc/rpc/dcerpc_connect.c:329:dcerpc_pipe_connect_ncacn_ip_tcp_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_ncacn_ip_tcp_recv
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_CONNECTION_REFUSED - NT_STATUS_CONNECTION_REFUSED

Could not find the CLASS: line - an error occurred
WMI DATA:$VAR1 = undef;
UNKNOWN - The WMI query had problems. The target host (myownip) did not allow our network connection. It is a valid name/IP Address. A firewall might be blocking us. There might be some critical services not running. Is it even running Windows? Wmic error text on the next line.
[librpc/rpc/dcerpc_connect.c:329:dcerpc_pipe_connect_ncacn_ip_tcp_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_ncacn_ip_tcp_recv
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_CONNECTION_REFUSED - NT_STATUS_CONNECTION_REFUSED

[mamir]

Also, I get the same error, when I put the target host IP address with the Raw query command.

-bash: QUERY:: command not found
[root@nsdnagios ~]# OUTPUT: [librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
-bash: syntax error near unexpected token `('
[root@nsdnagios ~]# [librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
-bash: syntax error near unexpected token `]'
[root@nsdnagios ~]# [wmi/wmic.c:196:main()] ERROR: Login to remote object.
-bash: syntax error near unexpected token `]'
[root@nsdnagios ~]# NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
-bash: NTSTATUS:: command not found
[root@nsdnagios ~]#
[root@nsdnagios ~]# Could not find the CLASS: line - an error occurred
-bash: Could: command not found
[root@nsdnagios ~]# WMI DATA:$VAR1 = undef;
-bash: WMI: command not found
[root@nsdnagios ~]# UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.
> [librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
> [librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
> [wmi/wmic.c:196:main()] ERROR: Login to remote objec

[mamir]

I see this below messages, when Iooked into the target host eventviewer-wmi-activity-Operational logs see below.

The event ID: 5858 (WMi Activity)

Id = {3A591B92-E24F-467A-8CDD-7EE83220DB70}; ClientMachine = ; User = ClientProcessId = 656; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BA; PossibleCause = Could not send status to client

[mamir]

Update: I was able to make it work using a local administrator account. I reimaged the target windows 2012 R2 server, it worked when its not on a domain, but one additional thing, I had to add the account to the "Performance Monitor Group". Now, I joined the same server to the our domain & using a domain account. it doesn't work. Please, assist with the domain account, because all our servers will be on domain.

[benjaminsmith]

Hi @mamir,

It looks like permissions setting is preventing access. Please take a look at the following Microsoft forum topic as I believe this is the issue.

Remote WMI on Server 2016 - Access Denied

[mamir]

Hello Support,

I tried this link, & also disabled UAC, still having no luck with my domain admin account which has full permission to the target machine.

Also when I put username does has it this format: domain/username

Please, assist furthur.