posted 02-15-2005 08:29 AM            

I get access denied error 0x80070005 when performing any WMI query or start process on a few computers. The common thing with these computers are that I am administrator through domain admins on these computers, they are running xp pro sp2 fully patched and a policy to turn off firewall, the remote registry service is on and no restriction in policy regarding connecting over network is in place. The WMI services are running.

I can start and stop services, see shares and other things.

I have searched through this nice forum and tested a command line for the firewall, checking with logon as with a few other accounts such as local administrator etc.

This drives me nuts =)

What things are required to run to make this work? At some other computers I also get an error that the computer is not configured for transactions, when trying to access shares.

Any help is appreciated.

/Andreas

//edit - I checked from XP and Win2003 and same result.

posted 02-15-2005 08:56 AM            

One thing that might be worth a test would be to run it locally on one of these computers to see if you can get WMI information. This might help determine if it has to do with accessing WMI remotely.

posted 02-15-2005 01:07 PM            

I got it to work, it sure was DCOM that was being obnoxious! Let me take return your help with the story of what it was:

Some time ago these computers seem to be infected with "r.bot" trojan/virus. The virus didnt do much besides scanning for cd-keys and stuff (or this is what i have been told). The virus was *not* discovered by the antivirus but instead a removal tool from an unnamed company was used. This tool removed the files, the registry changes except for these two:

HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
EnableDCOM = "N"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
restrictanonymous = "dword:00000001"

The darn virus increased the security (!) on the machine. I guess to cloak it from let say... tools usning DCOM =)

I got on the track after noticing some strange behaviour with dcomcnfg and then checking helpdesk logs. SP2 was applied *after* the removal and had absolutely nothing to do with the problems I described.

I can also confess that kicking the computers do not remedy nor help with this, but it feels much better.

Many many thanks to you, I would *not* have fixed this at all on my own. You got one happy IT-department sitting over here giggeling again with Hyena in their hands.

/Andreas

posted 04-30-2005 05:59 PM            

I just want to thank you for supplying you results. You've saved me from a major headache, and I'm SOOO happy. In most of my scripts, I attempt a standard WMI connection. If that fails, I use an alternate moniker asking the user for a different set of credentials. If THAT fails, I'm screwed (WMI-wise). But here's how I dealt with the WMI error (or inability to connect):

On Error Resume Next

(second attempt to connect, this time with alternate credentials)
Set objLocator = CreateObject("WbemScripting.SWbemLocator")

Set objWMIService = objLocator.ConnectServer(strComputer,strNamespace,strUser,strPassword)

If err.number <> 0 Then
'Change DCOM Reg Key
Dim objRegObjRegistry, objRemoteRegKeys, MsgRet, retPopup

MsgRet = MsgBox ("There was an error connecting to " & UCASE(strComputer) & "." & vbCrLf & _
"The reason for this could be that the credentials you entered were wrong or they have insufficient rights. " &_
"If you are sure that the credentials you entered were correct and you have Admin rights on " & UCASE(strComputer) &_
", it's very possible that the remote system has had DCOM turned off. If you believe this is the case, and " &_
"you wish to attempt to re-initialize DCOM on the remote system so this script will function correctly, " & _
"please click 'Yes', otherwise select 'No'.",4,"Failed to connect to " & UCASE(strComputer))

Select Case MsgRet
Case "6" 'Yes
Err.Clear
Set objRegObjRegistry = CreateObject("RegObj.Registry")

If Err.Number <> 0 Then ' a little error check, meaning the registry object editor isn't registered
WshShell.Popup "You most likely have not installed the proper tools on this workstation to run this script. " & vbCrLf & vbCrLf & _
"An attempt will now be made to install the proper tools to utilize this script.", 10, "Error - RegObj not installed"
WshShell.Run """\\server\tools$\Hyena\Install Custom Hyena Tools.bat""",0,True
'(for those wondering, this batch file loads all of our custom tools) WshShell.Popup "Please run this script again to ensure the tools installed properly. You must have" & _
" administrative rights to install these tools, and to effectively run this script.", 10, "Tool installation complete"
WScript.Quit
End If
' if we made it this far, set the actual remote registry object
Set objRemoteRegistry = objRegObjRegistry.RemoteRegistry(strComputer)
' assign the top key we're dealing With
strRegKeyPath = "\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE"

' set the remote registy key
Set strRemoteRegKey = objRemoteRegistry.RegKeyFromString(strRegKeyPath)

strRegKeyName = "EnableDCOM"
strRegKeyValue = "Y"
strRegKeyType = "1"

' try adding the key
strRemoteRegKey.Values.Add strRegKeyName, strRegKeyValue, strRegKeyType

WshShell.Popup "reg error: " & Err.Number & vbCrLf & Err.Description,5 ' for testing/debugging

If Err.Number = 35004 Or Err.Number = 35006 Then ' Key exists, so just change the value
Dim strRemRegErr : strRemRegErr = True
For Each objRemoteRegKeys In strRemoteRegKey.Values
If UCASE(objRemoteRegKeys.Name) = UCASE(strRegKeyName) Then
objRemoteRegKeys.Value = strRegKeyValue
End If
Next
Elseif strRemRegErr <> True Then 'access denied, most likely
WshShell.Popup "Failed to change the DCOM registry key on " & strComputer & ". You will need to " &_
"manually change the following key:" & vbCrLf & vbCrLf & _
"Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE" & vbCrLf & _
"Key: EnableDCOM" & vbCrLf & _
"Value: Y (the value is just the letter, not the word 'Yes'",0,"Failed to change registry key"
WScript.Quit

End If
retPopup = WshShell.Popup ("DCOM Registry Key changed. To make this change take effect, the remote system must be "&_
"restarted." & vbCrLf & vbCrLf & "Do you wish to restart the remote system? BEWARE, THIS WILL " &_
"ONLY GIVE THE REMOTELY LOGGED ON USER 60 SECONDS BEFORE RESTART!! Please ensure the remote system " &_
"is ready to be restarted",0,"DCOM Registry Key changed",4)

' here we use the good-ole shutdown command, since WMI won't do the trick
If retPopup = 6 Then WshShell.Run "\\server\tools$\Hyena\tools\shutdown -r -m \\" & strComputer &_
" -t 60 -c ""Your system must be restarted. Please save your work!""",0,False

Case "7" 'No
WScript.Quit
End Select
WScript.Quit

'On Error Resume Next
'Key Name, Key Value, Type of Key (0-None {not defined}, 1-Reg_Sz, 2-Reg_Expand_Sz, 4-Reg_Dword, 7-Reg_Multi_Sz)
'WScript.Echo strRegKeyName & vbCrLf & Err.Number
End If

Of course, I have to use the RegObj.dll file to access the registry, and the batch file loads and registers it on the local system running the script.

But again, thanks for pointing out that key!!