Detecting Windows XP sp2 clients with SIM 4.2sp2

[John Dawson_3]

Hi,

I am running HP SIM 4.2sp2 on my network, and I have just realized that it is consistently NOT detecting any client PCs running Windows XPsp2 during its automatic discovery. It is discovering the Windows 2000 clients with no problem.

I have the Windows XP firewall turned off on all my clients. Both my Win2k and WinXPsp2 clients have the HP Insight Manager agent (ver 5.01d) installed.

Any suggestions?

Thanks in advance!

John D.

[Aravindh Rajaram]

May be you can try this. Edit the system protocol settings of the XP machines and opt "only" for WBEM protocol and give the respective username and password for contacting WMI on those machines and then run a identification task on the XP machines. This should solve your problem.

[Mannalin]

Hi,

I have the same problem with you, do you have find a solution ?

Thanks in advance!

Thierry M

[Morgan Simonsen]

Hello

To solve this problem in your particular case (firewall disabled), you need to enable Anonymous Ramote Access permissions on your Windows XP SP2 machines:
To allow anonymous remote access in DCOM:

1. From the Start menu, click Run and type Dcomcnfg.exe.

2. In Component Services, click Console Root, click Component Services, click Computers, and then click My Computer. On the Action menu, click Properties.

3. In the My Computer Properties dialog box, on the COM Security tab, in the Access Permissions section, click Edit Limits.

4. In the Access Permission dialog box, select the check box to allow Remote Access for Anonymous Logon.

5. Restart the computer

Note that when you do this you disable a layer of protection for your machine, but since you are running without a firewall I guess this is not a problem in your environment.

For users with the Windows firewall enabled, you need to also do the following:
1. Open the SNMP Agents UDP port in the firewall; allow incoming connections on UDP port 161. Without this, the CSM cannot sent GET/GETNEXT/GETBULK commands to your machine, resulting in an incomplete discovery state.

2. Enable the RemoteAdministration exception in the Windows firewall:
From the command prompt type:
netsh firewall set service RemoteAdmin enable
This allows the CSM to connect to the WMI (WBEM) service on your machine. WMI registers it's port with the RPC endpoint mapper upon start, and you must have the RemoteAdmin exception to allow connections to it. (You could also open the WMI high-port specifically, but the port is selected at random on each service restart.)

3. Enable DCOM Anonymous Remote Access as described bove.

This worked with my XP SP2 machines.

Hope this helps!

PS: The documentation for SIM says that the standard port for WBEM is 5988/5989 and that you can query for WMI information at those ports, but Windows does not even listen on those ports. Strange...

[David Claypool]

Morgan: I don't think your 'Anonymous remote access' has anything to do with how you got this working since HP SIM uses specific credentials. What else did you do?

Regarding 5988/5989, these are the standard WBEM ports for secure HTTP communications of XML-encoded Common Information Model data. HP SIM uses these ports for communicating using WBEM.

Note that WBEM <> WMI. The 'Pegasus WMI Mapper' installed optionally with HP SIM exchanges WBEM information as above with HP SIM and is used to translate and map information for targets that are WMI devices. That is, using DCOM to communicate to the WMI device and cross-translating it to HP SIM via WBEM and mapping back and forth between the CIMv2 namespace and the WMI namespace.

[Morgan Simonsen]

Enabling Anonymous Remote Access for DCOM was the only thing I did to resolve this problem. The same symptom can be observed on similar systems, e.g. SMS 2003 where the administrator program and the advanced client stop working after XP SP2 is applied. Even though SIM uses credentials to connect to a system, the connection to WMI, through DCOM, is still anonymous. Have a look at this link for confirmation:http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/connecting_through_windows_firewall.asp

Best regards

Morgan

[David Claypool]

Sorry, Morgan, you're reading it incorrectly. Check this further information link from the page you specified:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/con
necting_to_wmi_on_a_remote_computer.asp

The most basic remote connection is from Computer A to a namespace on Computer B where:

* The account on Computer A is a member of the administrators group.
* The same username and password credentials identify an account on Computer B that is an administrator account.
* The password for the account on Computer A is not blank.

Computer A is the source computer connecting to a namespace on Computer B.

WMI makes no distinction between local and remote access. If no computer name is specified, a connection to WMI defaults to the local computer. To connect to a remote computer either in script or C++, supply the name of the remote computer in the connection. The difference between a local and a remote connection is that users can specify a user name and password in a remote connection, replacing the current user name and password. With a local connection, users cannot override the current name and password.