Skip to main content

Hello,

I have problem with push install iData agent to windows client.. I get error

„Description: Failed to install File System Core Package, the credentials entered may not have permission to use WMI on remote machine. Please check WMI configuration and user credentials.”

I enabled this on client

Review Considerations for Client Computers

  • For installations on Windows computers, you must configure the following settings:
    1. The Remote Registry service must be enabled and configured to automatically start during the computer startup.
    2. The Administrative Share must be enabled on the client.
  • For installations on UNIX computers that reside in a PowerBroker™️ environment, you must configure the settings described in Configuring PowerBroker Environments for Installations Using the CommCell Console.
  • For installations on EDC Discovered clients or virtual machines, you must configure the CommCell Browser to display these type of clients by completing the following steps:
    1. From the CommCell Console ribbon, on the Home tab, click Control Panel, and then click User Preferences.
    2. In the User Preferences dialog box, click the Client Computer Filter tab, and then select the check boxes corresponding to EDC clients or virtual machines.
  • Adding an admin user to the local Administrator group will not allow remote WMI access. To allow remote WMI access for an admin user, complete the following steps:

Note: This procedure was tested in Windows 7, Windows 8, and Windows 10.

    1. Add the user to the Performance Monitor Users group.
    2. Add the user to the DCOM Users group.
    3. Run wmimgmt.msc.

The wmimgmt window appears.

    1. Right-click WMI Control and then click Properties.

The WMI Control Properties dialog box appears.

    1. On the Security tab, select Root > CIMV2 and then click Security.

The Security for ROOT/CIMV2 dialog box appears.

    1. Add Performance Monitor Users and then allow the following options: Enable Account and Remote Enable.
    2. Click OK.

Review Firewall and Network Port Requirements

If you are installing the software on existing clients, you do not need to open additional network ports.

For new clients, you must temporarily open certain network ports to install the software remotely from the CommCell Console.

Note: All of the network ports listed in this section are inbound ports.

  • For UNIX, Linux, and Macintosh computers, enable SSH (Secure Shell), and then open port 22.
  • For Windows computers, do the following:
    • Open Port 135 for DCOM (Distributed Component Model).
    • Open Port 139 for NetBIOS Session Service (if you are using legacy Windows computers, such as Windows NT or earlier versions).
    • Open Port 445 for SMB (Server Message Block) file sharing.
    • Open the Windows Management Instrumentation (WMI) port. For instructions on setting up a fixed port for WMI, see Setting Up a Fixed Port for WMI on the Microsoft website.
    • Important: If Windows Firewall is enabled on the computer, do one of the following:
      • Temporarily open the following ports in Windows Firewall:

- Port 135 for DCOM-In (COM + Network Access)

- Port 445 for SMB

- WMI port

      • Set up a remote cache in the network where the computer resides.
    • Important: For a Windows 10 computer, if Windows Defender Firewall is enabled on the computer, open Port 135 for DCOM-In (COM + Network Access) and Port 445 for SMB in Windows Defender Firewall, and then do one of the following:
      • Enable the Windows Management Instrumentation rule (for Private, Public, and Domain) in the Inbound Rules of Windows Defender Firewall.
      • Enable the "Allow inbound remote administrator exception" in the Local Group Policy Editor (Local Group Policy Editor > Local Computer Policy > Administrative Templates > Network > Network Connections > Windows Defender Firewall > Domain Profile > Allow inbound remote administrator exception)


        Also telnet (IP address of backup server) IP address client machine 135
        doesnt work

        Best regards,
        Elizabeta

To check the registry, open regedit on the CommServe and choose 'File' and 'Connect to Network Registry'. Enter the target computer information and try to connect with the account used in the installation.

http://kb.commvault.com/article/INS0010

 
To test WMI from command line, run the following commands on the CommServe using the admin command prompt: 

C:\> wmic /node:etargetIPaddr] /user:radmin] process call create "cmd.exe /c ccommand]"
 
Examples:
wmic /node:(IP Address) /user:domain\user process call create "calc.exe"
wmic /node:(IP Address) /user:domain\user process call create "cmd /c Echo This is my WMI Test %Date% %Time% > C:\WMITest.txt"
 

There is also an issue that can be caused by recent Microsoft updates that have hardened WMI security. 
 
If the update below is only installed one machine and not the other, MSFT will block WMI communication. 
 
https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c


 


Reply