WMI Remote "Access Denied"

▲
1
▼

I can no longer remote access WMI on anything in my environment (10/8.1/XP/7 workstations). Here some specifics:

1) I am a Domain Admin and "MRT" is my user and password "mmmmn".

2) Since this happened I've been researching articles and have looked and verified the WMI and DCOM security settings were correct. I've tried changing the settings on several machines to see if anything would work with no success.

3) WBEMTEST works fine. I can connect locally and query anything I want. It does not work if I try it remotely. I recieve a "Number: 0x80070005 Access Denied" error.

4) I tested with "WMIC /node:172.16.98.12 /user:MRT /password:11111 computersystem get totalphysicalmemory" and got Access is denied response.

5) Scanned for virus' and malware and have turned up nothing.

Whats wrong? Obviously something changed in my environment is not respond for me.

windows
security
remote-access
remote
wmi
asked on Server Fault Apr 13, 2016 by M. Rostami

2 Answers

▲
1
▼

Try psexec with your command "WMIC /node:172.16.98.12 /user:MRT /password:11111 computersystem get totalphysicalmemory" psexec \172.16.98.12 -u MRT -p 11111 wmic computersystem get totalphysicalmemory

answered on Server Fault Apr 14, 2016 by ObereUA
▲
0
▼

The following command works against a Windows 10 machine:

wmic /user:"DOMAIN\AdminUser" /node:"computername" computersystem get totalphysicalmemory

I have had issues with wmic where I have the parameters in a different order and it fails. The exact command above (substituting real values for 'DOMAIN', 'AdminUser', and 'computername') works. There is a prompt for a password. If you remove the /user parameter it will use your current credentials and will work if you are logged in as an admin. The quotes (") are not always necessary, but are quite often required.

Windows 10 will stop executing wmic commands when certain errors occur. Once Windows 10 gets into this mode it needs to be rebooted. You can create a file like c:\test.txt on the test machine. If the following does not delete it, you probably need to reboot Windows 10 before it will accept any commands:

wmic /node:"computername" process call create "cmd.exe /c del c:\test.txt"
answered on Server Fault May 10, 2019 by trindflo • edited May 10, 2019 by trindflo

User contributions licensed under CC BY-SA 3.0