Remote WMI with Windows XP SP3

Question

A fresh Windows XP SP3 install does not allow remote WMI access like Windows XP SP2 does.

If I follow the steps in the "How to troubleshoot WMI-related issues in Windows XP SP2" document at http://support.microsoft.com/kb/875605 I'm unable to get SP3 to respond to a remote WMI request.

Every request, even to the built-in Administrator account, a new account in the Administrators group, or even a new account not in the Administrators group but given access to remote DCOM & the WMI namespace as described in the Microsoft document all return error code 0x80070005, Access is denied.

To verify I didn't have a goofy system configuration, I installed a fresh Windows XP SP3 image (using the .ISO image from MSDN) and performed no configuration changes save enabling RemoteAdmin through the Firewall. The Access is denied behavior was seen in this scenario as well.

What changed in Windows XP SP3 to remote DCOM / WMI access and how best to enable it?

Answer 1

I'm not sure if RemoteAdmin is the one you need to turn off or not in the firewall.

One suggestion would be to turn off the firewall completely first and try that. If it works, then you know it is the firewall. If this is the case, then I would try adding port tcp 135 directly and try again.

You may also try using telnet [ip address of XP_SP3 machine] 135 and see if you can establish the connection.

Hope this helps.

Answer 2

Supposedly SP3 does not check 'Enable Distributed COM on this computer'. Get into Component Services (dcomcnfg.exe) Component Services, Computers. Right click 'My Computer' and go to properties. 'Default Properties' is the tab you want. I have also heard that changing the DTC Logon account to NT AUTHORITY\NetwerkService (note the e instead of an o) will work. You can find this under the MSDTC tab, Security Configuration following the same path to My Computer.

We solved something very similar by using these tricks. Hope this helps.

Answer 3

It turns out the issue wasn't specific to SP3, but rather the lack of these systems being in a domain.

If XP isn't in a domain then the "Use Simple File Sharing" option, found in the Folder Options control panel applet, works it magic. If this option is enabled (the default) all file sharing connections are done with the guest user credential, but this also is applied to incoming DCOM connections as well.

Disabling this option allows DCOM connections to be verified as expected.