Allowing Remote WMI Access in a WORKGROUP

NetworkDetective and Allowing Remote WMI Access in a WORKGROUP

Notes

• The “netsh firewall” command on the newer versions of Windows will say it is depreciated and to use “netsh advfirewall” instead. Even though it says this, it did execute the command.
• Network Detective will only attempt queries verse PINGABLE IP Addresses. Therefore, make sure the computers in the WORKGROUP are pingable. The following command can be used if Windows Firewall is enabled:

netsh firewall set icmpsetting type=ALL mode=enable

Steps to Enable Remote WMI Access

1. Make sure you are using a username and password which matches between the client and the server.
2. Allow RemoteAdmin access through Windows Firewall (if enabled): netsh firewall set service RemoteAdmin enable
3. Enable DCOM (Distributed COM) permissions.  This might not be needed if the user is in the local computer’s Administrator group on the computer. The Administrator group already has these settings by default (although, they could have been changed).
   1. dcomcnfg
   2. Component Services > Computers > My Computer
   3. Right click My Computer
   4. Click on Properties
   5. Click COM Security tab
   6. Click Edit Limits under Launch and Activation Permissions (NOTE: Not under Access Permissions)
      
   7. Click Add
   8. Locate the windows user or user group you want to add exclusive rights to and click OK
   9. Select the user you just added
   10. Allow all checkboxes
   11. Click OK
   12. Click Apply
   13. Close dcomcnfg

4. Enable WMI namespace access rights. This might not be needed if the user is in the local computer’s Administrator group on the computer. The Administrator group already has these settings by default (although, they could have been changed).

1. 1. wmimgmt.msc
   2. Right click WMI Control
   3. Click on Properties
   4. Click on Security tab
   5. Click Security at the bottom
   6. Click on Advanced
   7. Click Add
   8. Locate the windows user or user group you want to add exclusive rights to and click OK
   9. Change the Apply to: drop down menu to This namespace and subnamespaces
   10. Click box to check Execute Methods, Enable Account, and Remote Enable permissions
   11. Click OK
   12. Click Apply
   13. Click OK
   14. Close wmimgmt

5. Verify Windows Management Instrumentation service is Running

1. services.msc
2. Scroll to Windows Management Instrumentation
3. Make sure it is running and set to Automatic
   

Extra Steps for Windows XP

Change ForceGuest setting in registry

1. regedit.exe
2. Expand HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control.
3. Select Lsa.
4. Change the value for the forceguest DWORD to 0:

Extra Steps for Windows 7 and Up

UAC blocks some (not all) WMI counters, resulting in error 80041003: The current user does not have permission to perform the action. . You can add the following registry key to disable this feature of UAC.

1. regedit.exe
2. Expand HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
3. 3.     Add a new DWORD value:

Name: LocalAccountTokenFilterPolicy

Value: 1

Testing Remote WMI Access

wmic /user:”user” /password:”yourpwd” /node:”hostname-or-ip” computersystem get name