Home / server / Questions / 713643
In Process
Todd Wilcox
Asked: 2015-08-13 06:43:47 +0800 CST

Windows 10 WMI and Event Viewer access denied

  • 772

We have a Windows domain where I used GPOs to enable remote management and monitoring of all of our workstations using WMI. I can also connect to all of our computers with Computer Management and start and stop services and look at event logs, etc. All of that works great.

Except:

We have one computer that was running Windows 8.1 Pro and all of the above remote management, etc. was working; and then we ugpraded it to Windows 10 Pro for testing. It seems like all GPOs have applied to Windows 10 also, but WMI is not accessible remotely, and (maybe related, maybe not) if I connect (successfully) with Computer Management, I can access all the usual things except the Event Viewer (and WMI security settings).

I've re-run winrm quickconfig, I've checked and allowed DCOM permissions and WMI permissions, and then re-started the WMI service, and I still can't connect to WMI remotely. Web searches for any Windows 10 problems are still not turning up good results, in general, and nothing for this problem that I've found.

Has anyone gotten remote access to WMI to work on a Windows 10 computer? If so, how?

Addenda:

  • WinRM service is set to automatic and is running.
  • Windows Firewall is disabled. Windows Firewall services is stopped and disabled.
wmi

4 Answers

  1. have you tried the following:

    • Checked a local wmi query to make sure there is not corruptions or anything from the local side?
    • Checked with procmon to see if there are any access denied messages on the remote machine or on the initiator side machine?
    • Make sure with gpresult or rsop that all the gpos you are using to set the permissions actually apply.

    In general i haven't seen this problem in our environment, but it sounds like a local corruption in wmi or a permissions that aren't set on the client side.

    shachaf

    • 1

  2. if Try to connect using the local administrator credentials of the windows 10 machine, DO you still get the access denied error ? Also try by disabling the UAC on the windows 10 machine.

    • 0

  3. Have you tried to check if you admin shares are enabled? I mean Admin$ and IPC$. Take a look at Computer Management > Shared Folders > Shares.

    If not, you can enable it by setting up this regkey:

    HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters\AutoShareWks (DWORD) = 1

    Restart and check if admin shares are on then try quering WMI remotely again.

    • 0

  4. I've run into the similar problem. My network is small and is using a WORKGROUP instead of a DOMAIN. I downloaded "WMIdiag" from Microsoft. It looks like DOMAIN authentication MUST be used.

    "WMI tasks remotely accessing WMI information on this computer and requiring Administrative privileges MUST use a DOMAIN account part of the Local Administrators group of this computer to ensure that administrative privileges are granted. If a Local User account is used for remote accesses, it will be reduced to a plain user (filtered token), even if it is part of the Local Administrators group."

    • 0