WMI Error Output: ERROR: Login to remote object.

[mamir]

Hello Support,

Using Nagios Xi, I'm trying to add a host (server) my first server, getting below message. I'm adding from configuration Wizard, & also credentials are correct, no special character, using a domain account, thats an administrator on the server, WMI service is started & everything. Is there anything additional needs to be done, I need to do it through WMI without the agent.

Please, respond to it, ASAAAAAP!

The wizard detected that the WMI plugin returned an unsuccessful output code. This will prevent the automatic scan of services and processes and prevent services from running successfully. Below is the given error output:

WMI Error Output:

UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.

[librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT

[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv

[wmi/wmic.c:196:main()] ERROR: Login to remote object.

NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

[mcapra]

Here's the general purpose WMI troubleshooting documentation:
https://support.nagios.com/kb/article/n ... g-579.html

I would suggest starting by running the plugin directly from the CLI of your Nagios XI machine, with extra debug information included. Here's an example of that from the above documentation:

Code: Select all

/usr/local/nagios/libexec/check_wmi_plus.pl -H 10.25.14.3  -u your_domain/your_user -p your_password -m checkcpu -w '80' -c '90'  --extrawmicarg "--debuglevel=4"

You'd just swap the -H, -u, and -p args out with the ones specific to the remote Windows machine. Be sure to sanitize any sensitive credentials when sharing the command output in this thread.

[mamir]

Hello,

I get these results, when I do putty (SSH) or Direct Console as below, please take look & let me know the problem here.

UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.
[param/loadparm.c:587:init_globals()] Initialising global parameters
[param/loadparm.clp_load()] lp_load: refreshing parameters from /dev/null
[param/params.c:556:pm_process()] params.c:pm_process() - Processing configuration file "/dev/null"
[param/loadparm.clp_load()] pm_process() returned Yes
[param/loadparm.clp_add_hidden()] adding hidden service IPC$
[param/loadparm.clp_add_hidden()] adding hidden service ADMIN$
[auth/kerberos/krb5_init_context.c:388:smb_krb5_init_context()] krb5_init_context failed (Invalid argument)
[auth/gensec/gensec.cgensec_register()] GENSEC backend 'sasl-DIGEST-MD5' registered
[auth/auth.c:447:auth_register()] AUTH backend 'winbind_samba3' registered
[auth/auth.c:447:auth_register()] AUTH backend 'winbind' registered
[auth/auth.c:447:auth_register()] AUTH backend 'name_to_ntstatus' registered
[auth/auth.c:447:auth_register()] AUTH backend 'fixed_challenge' registered
[auth/auth.c:447:auth_register()] AUTH backend 'unix' registered
[auth/auth.c:447:auth_register()] AUTH backend 'anonymous' registered
[auth/auth.c:447:auth_register()] AUTH backend 'sam' registered
[auth/auth.c:447:auth_register()] AUTH backend 'sam_ignoredomain' registered
[auth/gensec/gensec.cgensec_register()] GENSEC backend 'krb5' registered
[auth/gensec/gensec.cgensec_register()] gensec subsystem fake_gssapi_krb5 is disabled
[auth/gensec/gensec.cgensec_register()] GENSEC backend 'schannel' registered
[auth/gensec/gensec.cgensec_register()] GENSEC backend 'spnego' registered
[auth/gensec/gensec.cgensec_register()] gensec subsystem gssapi_spnego is disabled
[auth/gensec/gensec.cgensec_register()] GENSEC backend 'gssapi_krb5' registered
[auth/gensec/gensec.cgensec_register()] GENSEC backend 'gssapi_krb5_sasl' registered
[auth/gensec/gensec.cgensec_register()] GENSEC backend 'ntlmssp' registered
[lib/com/dcom/main.c:528:dcom_determine_rpc_binding()] Using binding ncacn_ip_tcp:10.250.1.204
[librpc/rpc/dcerpc_connect.c:513:continue_map_binding()] Mapped to DCERPC endpoint 135
[lib/com/dcom/main.c:413:determine_rpc_binding_continue2()] dcerpc_ndr_request_recv returned NT_STATUS_OK
[lib/com/dcom/main.c:417:determine_rpc_binding_continue2()] IObjectExporter::ServerAlive returned NT_STATUS_OK
[auth/gensec/gensec_gssapi.c:304:gensec_gssapi_client_start()] Cannot do GSSAPI to an IP address
[auth/gensec/gensec.c:606:gensec_start_mech()] Failed to start GENSEC client mech gssapi_krb5: NT_STATUS_INVALID_PARAMETER
[auth/ntlmssp/ntlmssp_client.c:128:ntlmssp_client_challenge()] Got challenge flags:
[auth/ntlmssp/ntlmssp.c:72:debug_ntlmssp_flags()] Got NTLMSSP neg_flags=0x62898205
NTLMSSP_NEGOTIATE_UNICODE
NTLMSSP_REQUEST_TARGET
NTLMSSP_NEGOTIATE_NTLM
NTLMSSP_NEGOTIATE_ALWAYS_SIGN
NTLMSSP_NEGOTIATE_NTLM2
NTLMSSP_CHAL_TARGET_INFO
NTLMSSP_NEGOTIATE_128
NTLMSSP_NEGOTIATE_KEY_EXCH
[auth/ntlmssp/ntlmssp_client.c:242:ntlmssp_client_challenge()] NTLMSSP: Set final flags:
[auth/ntlmssp/ntlmssp.c:72:debug_ntlmssp_flags()] Got NTLMSSP neg_flags=0x60088205
NTLMSSP_NEGOTIATE_UNICODE
NTLMSSP_REQUEST_TARGET
NTLMSSP_NEGOTIATE_NTLM
NTLMSSP_NEGOTIATE_ALWAYS_SIGN
NTLMSSP_NEGOTIATE_NTLM2
NTLMSSP_NEGOTIATE_128
NTLMSSP_NEGOTIATE_KEY_EXCH
[librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

[scottwilkerson]

We also need to make sure we are escaping special chars in the username/password
https://support.nagios.com/kb/article/n ... s-580.html

Additionally, verify that the user you are using does have access to the required items, per this document
https://assets.nagios.com/downloads/nag ... ios-XI.pdf

[mamir]

Hello Support,

I have used this password: Welcome12345678 (no special characters) at all.

Also, I have followed exactly the same document, step by step still the same problem happening. Is there anything especific needs to be done before I try to add this windows 2012 R2 server to be added via Windows WMI?

Please, assist further.

[scottwilkerson]

Had another user on our customer forum come across the same issue and another tech found this to be helpful (but it was on a 2016 system)

KB4487026

Addresses an issue that fails to set the LmCompatibilityLevel value correctly. LmCompatibilityLevel specifies the authentication mode and session security.

What do the NTLM options in highlighted in https://www.rootusers.com/implement-ntl ... rver-2016/ and the "LAN Manager authentication level" option look like now? Try setting the LAN Manager setting to the different options and testing them with the check_wmi_plus plugin.

The end user said setting check_wmi_plus to use NTLMv2 seems to clear up the issue

[mamir]

Hello Support,

I have selected each settings under "Network Security: LAN Manager Authentication Level" I changed to each one of them & tried still same thing.

Also, wanted to check does this host has to be added first using the Nagios Core Config Manager? or I can use the configuration wizard directly? Because this is my first host, im trying to add into Nagios xi & thats not even working.

https://assets.nagios.com/downloads/nag ... gement.pdf

[scottwilkerson]

Can you confirm you followed all of the setup for this user and host in this doc?
https://assets.nagios.com/downloads/nag ... ios-XI.pdf

Also when testing the command you are using your_domain/your_user instead of your_domain\your_user correct?

[mamir]

Hello Support,
Yes, I have follow the document, every single step. I basically used a domain user account a test account & added that account to local administrator group with in the target host thats all & followed each step in the document.

Also, I used in Nagios domian/username see the errors below.


WMI Error Output:

UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.

[librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT

[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv

[wmi/wmic.c:196:main()] ERROR: Login to remote object.

NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

[scottwilkerson]

Can I have you attempt a "raw query" ad described in this article
https://support.nagios.com/kb/article/n ... g-579.html