Control Compliance Suite (CCS)

Agentless data collection or Asset Import jobs fail on a Windows asset with one or more of the following errors: 

"RPC Server is unavailable"

"WMI failure: Connecting to \\Example.com\root\default"

"Access is denied"

"The Network Path was not found"

CCS 12.6.x Agentless data collection or Asset Import

1. PORT COMMUNICATIONS

   • Verify that the Windows targets are connected to the Network, and able to communicate through RPC and TCP/IP ports with the CCS Manager Machines.  
     • For Agentless data collection, ports 135,137,139,445 need to be opened between the CCS Manager and the Windows target server. 
     • Use the telnet application or Powershell on the CCS Manager to connect on Ports 135,139 & 445 on the Windows target server.
       See KB Using Telnet or Powershell to troubleshoot connectivity between CCS components. for detailed steps to test connectivity.  
     • If Telnet or Powershell test fails, check for firewalls between the CCS Manager and the target which might be blocking these ports.  Also, check any Local Firewall on the target machine if there is no physical Firewall between the CCS Manager and the Targets.  Open these ports on the Local Firewall (Inbound/Outbound Rules) if necessary.
       
       

2. SERVICES

   Make sure that the following Services are running on the Windows target asset.

   • Remote Procedure Call (RPC)
   • Computer Browser
   • Server
   • Remote Registry
   • Windows Management Instrumentation
   • Netlogon
   • Remote Desktop Services
   • Windows Remote Management (WS-Management)
     
     

3. TEST UTILITIES

   • The Windows utility "wbemtest" can be run on the CCS Manager Machines from a command prompt or Powershell window (run the command prompt or Powershell 'as Administrator')
     1. Type wbemtest on the command prompt of the CCS Manager.  When the 'Windows Management Instrumentation Tester' window opens, click the Connect button.
     2. In the Namespace field type:  \\##.##.##.##\root\default  (replace the hashes with the IP of the Windows target server)
     3. In the Credentials section, enter the credentials being used by CCS for data collection on this target machine and then click Connect
     4. If wbemtest can connect, then you should be returned to the first page and will be connected.  Otherwise, an error will occur. 
        NOTE: As wbemtest is a Microsoft application, this demonstrates that the issue is most likely the configuration on the target machine and not CCS based problem.
        
        

4. SETTING WMI PERMISSIONS

   •     To set WMI permissions, on the Windows target machine do the following 
     • Click Start > Run > type wmimgmt.msc, and then click OK.  
     • On the resulting screen, right-click WMI Control and click Properties > Security tab > expand Root, and then click Default (or the failing node). Click the Security button and then the  Advanced button.
     • On the Advanced Security Settings screen, double-click on the CCS Service account (or the group containing the CCS Service account) and ensure it has the Enable Account and Remote Enable permissions checked.  If those permissions are not enabled, enable those permissions.
       
       
   • NOTE:  The wmimgmt.msc may not run on certain machines due to Internet security settings. You may not have access to change the internet security settings on the target machine in order to use this tool, there may be a GPO enforced setting.  Instead you can use the Computer Management utility to grant WMI permissions.  Please search for instructions on how to grant WMI permissions using Computer Management utility.
     
     

5. LESS LIKELY SETTINGS TO LOOK AT

   • NOTE: Internet security policies can cause the group policy editor not to be available.
     
     
     • On the remote computer, open gpedit.msc, open Computer Configuration, open Administrative Templates, open Network, open Network Connections, open Windows Firewall, and then open either Domain Profile or Standard Profile, depending on which profile you want to configure. Enable the following exception: "Allow Remote Administration Exception" and "Allow File and Printer Sharing Exception".
       
       

6. After completing the steps above, RETEST with wbemtest (step 3) to verify that it works.
   
   

7. REPAIRING WMI

The following suggestions are at the risk of the user.  They are often recommended by Microsoft articles, however, consultation with Microsoft is always recommended.

Depending on your version of Windows, these are the following ways to repair/rebuild/reset WMI on your machine.  (this has been tested on Windows 2022)

1. Open a command prompt (as administrator). 
   • Type the following command:  winmgmt /salvagerepository
     1. The above command performs a consistency check on the WMI repository, and if an inconsistency is detected, rebuilds the repository.
        The content of the inconsistent repository is merged into the rebuilt repository if it can be read.