| Author |
 Topic  |
|
|
rmoore@afsc.org
Here To Stay
USA
260 Posts
Status: offline |
 Posted - 04/18/2012 : 2:34:26 PM
|
I've been installing the DPM agent on some client computers. Some are XP, some are Windows 7. All have gone fine except one XP install. I install the agent on the XP computer no problem. Then when I try to attach it to my DPM server, I get this error:
Attach protected computer CON-3B2DX91.AFSC.local failed:
Error 402: When trying to retrieve information from the Windows Management Instrumentation (WMI) service on CON-3B2DX91.AFSC.local, access was denied.
Recommended action: Verify that you have access to the WMI service on CON-3B2DX91.AFSC.local.
I've tried searching on that error, but haven't come up with much. One thing I found on Technet suggested deleting a certain registry key (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MicrosoftFirewall\DomainProfile\RemoteAdminSettings) but that key doesn't exist--in fact the "MicrosoftFirewall" key, and all the sub keys, don't exist.
So, anyone got any good ideas about how to address this? I've tried rebooting and also removing and reinstalling the agent.
Thanks,
Rob
|
|
|
rmoore@afsc.org
Here To Stay
USA
260 Posts
Status: offline |
Posted - 04/18/2012 : 2:36:14 PM
|
I should add that I don't know how to "verify that I have access to the WMI service" (tried searching on that, too).
Rob |
 |
|
|
wkasdo
Administrator
Netherlands
7405 Posts
Status: online |
Posted - 04/18/2012 : 2:47:22 PM
|
for remote connectivity tests, try wbemtest.
You might want to check that remote registry is running on the XP machine. |
Make it as simple as you can, but not simpler -- Albert Einstein |
|
|
|
rmoore@afsc.org
Here To Stay
USA
260 Posts
Status: offline |
Posted - 04/19/2012 : 08:32:04 AM
|
Remote Registry service is running.
WBEMTEST -- wow, I've never seen anything quite so opaque. No idea what to do with that. The Help is useless.
Any other ideas or suggestions? Hints about how to use WBEMTEST to troubleshoot this problem?
Rob |
|
|
|
rmoore@afsc.org
Here To Stay
USA
260 Posts
Status: offline |
Posted - 04/19/2012 : 2:35:51 PM
|
So far I have run the WMI Diagnostics Utility (http://msdn.microsoft.com/en-us/library/windows/desktop/aa394603(v=vs.85).aspx), which found some problems. I used dcomcnfg.exe to try to fix the problems. I also found that there was an old SMS client on the computer (we haven't used SMS for a few years now) and removed that.
I've also unjoined the PC from the domain and then re-joined it.
So far, no joy.
Rob |
|
|
|
rmoore@afsc.org
Here To Stay
USA
260 Posts
Status: offline |
Posted - 04/19/2012 : 2:39:22 PM
|
Actually, the error message of the failure is different now. First the attachment of the client claims to succeed, but then back in the DPM console, the DPM server is unable to contact the client. I get this error message:
Data Protection Manager Error ID: 270
The agent operation failed on con-3b2dx91.afsc.local because DPM could not communicate with the DPM protection agent. The computer may be protected by another DPM server, or the protection agent may have been uninstalled on the protected computer.
If con-3b2dx91.afsc.local is a workgroup server, the password for the DPM user account could have been changed or may have expired.
Check the following to troubleshoot this issue:
1) If the agent is not installed on con-3b2dx91.afsc.local, run DpmAgentInstaller.exe with this DPM computer as a parameter. For details, see the DPM Deployment Guide.
2) To attach the computer correctly to this DPM server, run the SetDpmServer tool on the protected computer.
3) If the computer is protected by another DPM server, or if the protection agent has been uninstalled, remove the protected data sources on this computer from active protection. Then, remove the entry of this computer from the Agents tab in the Management task area.
4) If con-3b2dx91.afsc.local is a workgroup server, run SetDpmServer with the -UpdatePassword flag on the protected computer and Update-NonDomainServerInfo.ps1 on the DPM server to update the password.
5) If the DPM server and the protected computer are not in the same domain, ensure that there is a two-way trust setup between the two domains.
I guess I'll continue working on it tomorrow.
Thanks,
Rob |
|
|
|
rmoore@afsc.org
Here To Stay
USA
260 Posts
Status: offline |
Posted - 04/20/2012 : 11:03:55 AM
|
I finally seem to have stumbled on a solution. I'm not sure what the ramifications are, though.
On social.technet.microsoft.com (http://social.technet.microsoft.com/Forums/en-US/dataprotectionmanager/thread/132dff35-1471-453c-bf4f-904d297d43aa/) I found a suggestion to add the DPM server's computer account to the Domain Admins group. That does seem to have fixed the problem. I tried then removing the DPM server from the Domain Admins group and then the error came back. So the problem is only fixed if the DPM server's account stays in the Domain Admins group.
So my question is, is it a bad thing to leave a computer account in the Domain Admins group?
Thanks,
Rob |
|
|
|
rmoore@afsc.org
Here To Stay
USA
260 Posts
Status: offline |
Posted - 04/26/2012 : 10:31:00 AM
|
Somebody over in the AD forum suggested taking the server's computer account out of the Domain Admins group and putting it into the local admin group on the problematic workstation. That worked! Seems like a much lower-risk thing to do.
Rob |
|
|
| |
Topic |
|
Trouble accessing WMI Service on XP Install
