WMI over DCOM on servers with SMB 1.0 disabled (4294210)

Any agent using WMI over DCOM for the initial connection setup fails to connect to some Windows servers, even after following KB 102431.

The Credential Alarm generated contains the following message:

Failure: Cannot establish connection to HOSTNAME: AccessIsDenied (0xc0000001) while connecting as exampledomain/foglight_svc to HOSTNAME. .  Please ensure that the Remote Registry and Server services are running and the connecting user has permission to modify these registry keys: {76A64158-CB41-11D1-8B02-00600806D9B6}, {76A6415B-CB41-11d1-8B02-00600806D9B6}. There may be multiple instances of each key, especially for 64-bit versions of Windows Server 2008 R2 and Windows 7. Each instance will need to be updated.  [Caused by: JIException ]

Most organizations have started to disable SMB 1.0 in all Windows Machines and template images, due to current security standards. Windows Server 2019 and higher have SMBv1 service disabled by default. 

To confirm, please run this Powershell cmdlet:

Get-WindowsOptionalFeature -Online -FeatureName smb1protocol

SMBv1 is only needed for initial setup to create a few values in the Windows Registry so that the DCOM connection can be established.

Solution 1

Enable SMBv1 by adding the SMB 1.0/CIFS Server optional feature to Windows. This can be done using the Add Roles and Features Wizard.

This protocol can be disabled after the first collection and the special values have been added to the Windows Registry.

Solution 2

The Hyper-V DCom powershell script is known to work to prepare the monitored Windows Server 2019 host to be collected from without needing to setup any SMBv1 connection. This can be downloaded from Components for Download in any Foglight for Virtualization Enterprise Edition or Foglight Evolve environment.

Solution 3

Create these values in the Windows Registry manually as instructed in the Agent Manager guide.

Disclaimer: Support does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support.