WMI Access issues

[05hammer]

I have a 2k3 standard edition server that has been running E2k3
flawlessly over the past 14+ months. Yesterday I configured automatic
updates, and BITS, connected it to my internal WSUS server and it
downloaded several patches, installed them, and rebooted.
Now I get a ton of errors in range from Backup Exec Job Engine
failure, RSoP failure, VSS Errors, MsiInstaller Errors, MAD Monitoring
thread failure, Failure to access the metabase...and they all seem to
come down to WMI. When I try to access WMI via Computer Management >
Services and applications > WMI Control > Properties, I get "Failed to
connect to \\server.blah.blah because "Win32: Access is denied."

REgardless of who I am logged in as, I keep getting that error. I'm
thinking one of the patches yesterday fu'd up a security setting
somewhere but I havn't a clue where to look.

This is also the case when I try to access IIS, restart BAckup Exec Job
Engine, Certificate Services, and a Device lock Service I have. They
all get access denied no matter who I try to start them as.

Any guesses would be greatly appreciated. As it stands It looks like I
will be going through each patch to see which ones mess with WMI.

[Gerry Hickman]

Hi 05hammer,

> failure, RSoP failure, VSS Errors, MsiInstaller Errors, MAD Monitoring
> thread failure, Failure to access the metabase...

Doesn't sound good!

> and they all seem to
> come down to WMI.

Have you tried running some test scripts against WMI locally, or using
WBEMTEST?

> When I try to access WMI via Computer Management >
> Services and applications > WMI Control > Properties, I get "Failed to
> connect to \\server.blah.blah because "Win32: Access is denied."

You mean even on the local machine?

> REgardless of who I am logged in as, I keep getting that error. I'm
> thinking one of the patches yesterday fu'd up a security setting
> somewhere but I havn't a clue where to look.
>
> This is also the case when I try to access IIS, restart BAckup Exec Job
> Engine, Certificate Services, and a Device lock Service I have. They
> all get access denied no matter who I try to start them as.

Check the Event logs after rebooting it, and see if there are any errors
in there.

--
Gerry Hickman (London UK)

[05hammer]

Yep, it was even on the local machine.

After I posted this, I hunted down all the install times of each patch
that was done. Then I hunted around the wbem directory to see what I
could see. I noticed in the setup.log file in
windows/system32/wbem/logs directory that at 14:05 a series of entries
about "beginning WBEM Serivce Pack installation" appeared. Then in the
mofcomp.log, also at 14:05 a bunch of files began parsing and
compiling. Then at 14:21 the errors began -

"parsing MOF file: C:\windows\system32\Wbem\SceRsop.mof"...An error
occured while opening the namespace for object 1 defined on lines 10 -
13: error number: 0x80070005, facility: Win32 Description: Access is
denied.

Did the same thing for Rsop.mof with object 1 lines 5 - 8, and
exwmi.mof with object 1 lines 10 - 13.

The only patch that was loaded during that time frame was W2k3 SP1.
So, I un-installed it, rebooted, and regained access to WMI...somewhat.
It is still a bot crippled, but now IIS is running, Backup Exec is
running, Cert srv is running.

Now when I connect to WMI Control, instead of getting Win32: Access
Denied, I get:

Failed to initialize all required WMI Classes

Win32_Processor: Windows: Server execution failed
Win32_WMISetting: Successful
Security information: Successful
Win32_OperatingSystem: Windows: Server execution failed

The LAST thing I need to do right now is re-install this system.
Downtime is not really an option right now.