Agent fails with error "AccessIsDenied (0x80070005)" (4345315)

During the installation of a Foglight agent or when verifying credentials, the following error may appear in the Credential Alarm message or during connection verification:

Cannot establish connection to SERVERNAME: AccessIsDenied (0x80070005) while connecting as DOMAIN\svc_account. Ensure that the remote machine has been prepared to accept incoming DCOM connections and that the username/domain/password are correct [Caused by: Invoke of: ConnectServer Source: SWbemLocator Description: Access is denied.]

Alternatively, the following message may be seen:

Failure: Cannot establish connection to SERVERNAME: AccessIsDenied (0x80070005) while connecting as the local user to SERVERNAME. Ensure that the remote machine has been prepared to accept incoming DCOM connections, including that all DCOM permissions have been granted for the user. Also, ensure that the username/domain/password are correct [Caused by: ComFailException <Invoke of: ConnectServer Source: SWbemLocator Description: Access is denied. >]

Note: These errors are typically found in alarm messages and may not appear in the agent logs.

This issue occurs when the user account used by the Foglight agent does not have sufficient permissions to access WMI over DCOM on the monitored host. The 'Access is denied' (0x80070005) error indicates that the remote system is rejecting the connection due to insufficient DCOM or WMI namespace permissions. This can happen if:

• The user is not a member of the Local Administrators group on the monitored host.
• DCOM permissions have not been granted to the user.
• WMI namespace security settings do not allow the user to connect and query.
• The monitored host is not configured to accept remote DCOM connections.
• Remote Registry and Server services Windows service is not running on the remote host

RESOLUTION 1

1. Ensure the user account is a member of the Local Administrators group, or configure explicit DCOM and WMI permissions if using a non-admin account, please review KB 4295692.
2. Open 'dcomcnfg' and navigate to:
      - Component Services > Computers > My Computer (right-click) > Properties > COM Security tab.
      - Under 'Launch and Activation Permissions', click 'Edit Limits' and 'Edit Default'.
      - Add the user and grant 'Remote Launch' and 'Remote Activation' permissions.
3. Configure WMI namespace permissions:
      - Open 'wmimgmt.msc', right-click 'WMI Control' > Properties.
      - Go to the 'Security' tab, select 'Root\CIMV2', click 'Security'.
      - Add the user and grant 'Enable Account' and 'Remote Enable' permissions.
4. Ensure the Windows Firewall allows WMI/DCOM traffic or temporarily disable it for testing.
5. Restart the WMI service or reboot the monitored host if necessary.
6. Retry the credential verification or agent installation in Foglight.

RESOLUTION 2

Confirm the login id and password used for monitoring. A trust should exist if the login id is from another domain for the Windows login to be successful.

See KB 4033088 for details on using WBEMTEST to test DCOM connectivity and permissions.

RESOLUTION 3

When the Foglight Agent Manager is installed on the monitored host, use local monitoring instead of remote monitoring

• Use a "Local user" in the credentials area with a "Use client's login at connection time" credential.

RESOLUTION 4

Check that the Remote Registry and Server services are running on the monitored host.