Discussion Forums/AA Console/Tips & Tricks

WMI Access Denied

Adam Ruth
posted this on November 13, 2009 14:07

When scanning a target computer an error may show up in the Console machine's Windows Event Log. The event "WMI Access Denied" is most likely caused by DCOM security settings. There are two ways you can remedy this. One is using a utility provided by Brisworks and included in Admin Arsenal OR you can visit the target computer.
You can fix this problem using the command: DCOMACLS.EXE which is included with Admin Arsenal. Here is the usage statement for dcomacls.exe

Set DCOM security properties
Version 1.1.1014.0
© 2007 Brisworks, All Rights Reserved

Usage:
dcomacls [\\computer\right] [allow/deny/none] [user or group]

The following rights (and their abbreviations) are supported:
AL access-limits
AL.L access-limits-local
AL.R access-limits-remote
LL launch-limits
LL.LL launch-limits-local-launch
LL.RL launch-limits-remote-launch
LL.LA launch-limits-local-activation
LL.RA launch-limits-remote-activation

Omitting the computer name or using a dot will cause the rights to be set on the local computer.

Examples:
dcomacls access-limits-local allow administrators
dcomacls \\server1\access-limits-local allow administrators
dcomacls al none domain\user.name
dcomacls \\.\ll none domain\user.name

For more information, consult the Admin Arsenal documentation.

Running this command will fix DCOM Access Is Denied errors:

This command will add the Administrators as a group that has the ALLOW rights on Local Access Limits.

dcomacls al.l allow Administrators

This command below will add the Administrators as a group that has the ALLOW rights no Remote Access Limits.

dcomacls al.r allow Administrators

To run this same command over the network to a target system you would run:

dcomacls \\computername\al.r allow administrators

You can also run this from a system level GPO (have the GPO run a script which calls this command)

To manually perform these steps, go to the affected computer and follow these steps:

select Start \ Run and type:

dcomcnfg

This will open up the Component Services. Expand Component Services under Console Root in the left pane. In the computers directory right-click on "My Computer" and select Properties. The window My Computer Properties opens. Go to the COM Security tab.

In the "Access Permissions" AND "Launch and Activation Permissions" section select Edit Limits. In the "Group or user names:" section add Administrators (or the group you wish to add). With Administrators selected verify that Local Access and Remote Access both have the "Allow" permission granted.

A reboot may be necessary. The WMI errors should no longer appear.