1

I can no longer remote access WMI on anything in my environment (10/8.1/XP/7 workstations). Here some specifics:

1) I am a Domain Admin and "MRT" is my user and password "mmmmn".

2) Since this happened I've been researching articles and have looked and verified the WMI and DCOM security settings were correct. I've tried changing the settings on several machines to see if anything would work with no success.

3) WBEMTEST works fine. I can connect locally and query anything I want. It does not work if I try it remotely. I recieve a "Number: 0x80070005 Access Denied" error.

4) I tested with "WMIC /node:172.16.98.12 /user:MRT /password:11111 computersystem get totalphysicalmemory" and got Access is denied response.

5) Scanned for virus' and malware and have turned up nothing.

Whats wrong? Obviously something changed in my environment is not respond for me.

M. Rostami
  • 127
  • 1
  • 2
  • 13

2 Answers2

1

Try psexec with your command "WMIC /node:172.16.98.12 /user:MRT /password:11111 computersystem get totalphysicalmemory" psexec \172.16.98.12 -u MRT -p 11111 wmic computersystem get totalphysicalmemory

ObereUA
  • 26
  • 2
  • Thanks, I try with this command "WMIC /node:172.16.98.12 /user:MRT /password:11111 computersystem get totalphysicalmemory" on Windows 8.1 and got true response. But Windows 10 got "Access is denied" error and on Windows XP I don't understand configuration. – M. Rostami Apr 15 '16 at 08:19
0

The following command works against a Windows 10 machine:

wmic /user:"DOMAIN\AdminUser" /node:"computername" computersystem get totalphysicalmemory

I have had issues with wmic where I have the parameters in a different order and it fails. The exact command above (substituting real values for 'DOMAIN', 'AdminUser', and 'computername') works. There is a prompt for a password. If you remove the /user parameter it will use your current credentials and will work if you are logged in as an admin. The quotes (") are not always necessary, but are quite often required.

Windows 10 will stop executing wmic commands when certain errors occur. Once Windows 10 gets into this mode it needs to be rebooted. You can create a file like c:\test.txt on the test machine. If the following does not delete it, you probably need to reboot Windows 10 before it will accept any commands:

wmic /node:"computername" process call create "cmd.exe /c del c:\test.txt"
trindflo
  • 1
  • 2
  • This isn't really an answer, it seems to be "it works for me." – Ward - Reinstate Monica May 10 '19 at 02:41
  • I hear what you are saying. Sometimes having a template that works will solve the problem. A specific difference I can see is that I am supplying the domain, and supplying as a prefix rather than a postfix (e.g. '@domain.com'). I am suggesting they do something different, and I will remove the offending string. – trindflo May 10 '19 at 16:38
  • @trindflo It has helped me. Thank you. – M. Rostami May 14 '19 at 10:12