Remote WMI with Windows XP SP3

Question

A fresh Windows XP SP3 install does not allow remote WMI access like Windows XP SP2 does.

If I follow the steps in the "How to troubleshoot WMI-related issues in Windows XP SP2" document at http://support.microsoft.com/kb/875605 I'm unable to get SP3 to respond to a remote WMI request.

Every request, even to the built-in Administrator account, a new account in the Administrators group, or even a new account not in the Administrators group but given access to remote DCOM & the WMI namespace as described in the Microsoft document all return error code 0x80070005, Access is denied.

To verify I didn't have a goofy system configuration, I installed a fresh Windows XP SP3 image (using the .ISO image from MSDN) and performed no configuration changes save enabling RemoteAdmin through the Firewall. The Access is denied behavior was seen in this scenario as well.

What changed in Windows XP SP3 to remote DCOM / WMI access and how best to enable it?

Solution 1

It turns out the issue wasn't specific to SP3, but rather the lack of these systems being in a domain.

If XP isn't in a domain then the "Use Simple File Sharing" option, found in the Folder Options control panel applet, works it magic. If this option is enabled (the default) all file sharing connections are done with the guest user credential, but this also is applied to incoming DCOM connections as well.

Disabling this option allows DCOM connections to be verified as expected.

Solution 2

Supposedly SP3 does not check 'Enable Distributed COM on this computer'. Get into Component Services (dcomcnfg.exe) Component Services, Computers. Right click 'My Computer' and go to properties. 'Default Properties' is the tab you want. I have also heard that changing the DTC Logon account to NT AUTHORITY\NetwerkService (note the e instead of an o) will work. You can find this under the MSDTC tab, Security Configuration following the same path to My Computer.

We solved something very similar by using these tricks. Hope this helps.

Comments

[dcgibbons]

Yep, RemoteAdmin is the right component for the firewall. With the firewall off the same behavior is seen. If the firewall is getting in the way I'd expect a timeout or similar error instead of an quick Access is denied error.

[dcgibbons]

Looks like Enable Distributed COM on this computer was already enabled here. :(