Infameous 0x80070005 ERROR: Access denied

Bkiddo · Oct 18, 2006

Hi, my name is Beatriz and I'm another victim of the 0x80070005 from
Hell. I'm running WBEMTEST from a PC to connect to another one with WXP
SP2 and even:

1. The firewall is down.
2. Applied the commands:
netsh firewall set service RemoteAdmin enable
netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135
3. Did the workaround suggested in:
http://support.microsoft.com/kb/909444
4. Ran the workaround in: http://support.microsoft.com/kb/884573
5. Added the account I use to access by Wbemtest with to the Default
Lauch Permissions with Full Control.
6. Checked up the registry
:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\forceguest
were set to 0.

I keep not being able to connect, and receving 0x80070005, what I'm
missing?!?!?!?

James Crosswell · Oct 18, 2006

Bkiddo said:
Hi, my name is Beatriz and I'm another victim of the 0x80070005 from
Hell. I'm running WBEMTEST from a PC to connect to another one with WXP
SP2 and even:

Is the account you are using a Domain Admin? If not, make it so. That
seems to be the only easy way to access remote machines with WMI/RPC.

Best Regards,

James Crosswell
Software Engineer
Microforge.net LLC
http://www.microforge.net

EDI · Oct 18, 2006

I was trying it for days on end and kept getting that error and it may
well be that your issue is totally different but just as a suggestion
it may be worth while getting microsofts wmi util to check wmi on both
your machines.

http://www.microsoft.com/downloads/...D6-18D1-4D05-B11E-4C64192AE97D&displaylang=en

If it checks out ok on both machines then it depends on other things (
even though you disabled the windows firewall ive had issues with it
and i always add it as exceptions into the windows firewall. also are
you running any other firewalls ie zone alarm or even have a router or
something else that may be blocking it from working correctly ?

Post back and let us know what happens with the diag tools etc.

Bkiddo · Oct 18, 2006

James,

Yes, the account is a Domain Administrator and is also part of Local
Administrator Group in the WinXP I try to connect to,

The windiag reported this, I don't see anything abnormal, do you?

20088 14:34:30 (0) ** -------------------------------------- WMI
REPORT: BEGIN -------------------------------------------
20089 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20090 14:34:30 (0) **
20091 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20092 14:34:30 (0) ** Windows XP - Service pack 2 - 32-bit - User
'UDEM\SMARTINEZ38' on computer 'DISEPC026225'.
20093 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20094 14:34:30 (0) ** System drive:
...............................................................................
C: (Disk #0 Partition #0)
20095 14:34:30 (0) ** Drive type:
.................................................................................
IDE (WDC WD400BB-23FJA0)
20096 14:34:30 (0) ** There are no missing WMI system files:
...................................................... OK.
20097 14:34:30 (0) ** There are no missing WMI repository files:
.................................................. OK.
20098 14:34:30 (0) ** BEFORE running WMIDiag:
20099 14:34:30 (0) ** The WMI repository has a size of:
........................................................... 8 MB.
20100 14:34:30 (0) ** - Disk free space on 'C:':
.................................................................. 25896
MB.
20101 14:34:30 (0) ** - INDEX.BTR, 1540096 bytes,
17/10/2006 02:05:01 p.m.
20102 14:34:30 (0) ** - INDEX.MAP, 808 bytes,
17/10/2006 02:18:16 p.m.
20103 14:34:30 (0) ** - MAPPING.VER, 4 bytes,
17/10/2006 02:18:16 p.m.
20104 14:34:30 (0) ** - MAPPING1.MAP, 4236 bytes,
17/10/2006 02:18:16 p.m.
20105 14:34:30 (0) ** - MAPPING2.MAP, 4236 bytes,
17/10/2006 02:10:12 p.m.
20106 14:34:30 (0) ** - OBJECTS.DATA, 6987776 bytes,
17/10/2006 02:10:12 p.m.
20107 14:34:30 (0) ** - OBJECTS.MAP, 3440 bytes,
17/10/2006 02:18:16 p.m.
20108 14:34:30 (0) ** AFTER running WMIDiag:
20109 14:34:30 (0) ** The WMI repository has a size of:
........................................................... 8 MB.
20110 14:34:30 (0) ** - Disk free space on 'C:':
.................................................................. 25877
MB.
20111 14:34:30 (0) ** - INDEX.BTR, 1540096 bytes,
17/10/2006 02:05:01 p.m.
20112 14:34:30 (0) ** - INDEX.MAP, 808 bytes,
17/10/2006 02:18:16 p.m.
20113 14:34:30 (0) ** - MAPPING.VER, 4 bytes,
17/10/2006 02:18:16 p.m.
20114 14:34:30 (0) ** - MAPPING1.MAP, 4236 bytes,
17/10/2006 02:18:16 p.m.
20115 14:34:30 (0) ** - MAPPING2.MAP, 4236 bytes,
17/10/2006 02:10:12 p.m.
20116 14:34:30 (0) ** - OBJECTS.DATA, 6987776 bytes,
17/10/2006 02:10:12 p.m.
20117 14:34:30 (0) ** - OBJECTS.MAP, 3440 bytes,
17/10/2006 02:18:16 p.m.
20118 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20119 14:34:30 (2) !! WARNING: Windows Firewall:
..................................................................
INACTIVE.
20120 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20121 14:34:30 (0) ** WMI registry setup:
.........................................................................
OK.
20122 14:34:30 (0) ** INFO: WMI service has dependents:
........................................................... 3
SERVICE(S)!
20123 14:34:30 (0) ** - Security Center (WSCSVC, StartMode='Automatic')
20124 14:34:30 (0) ** - Windows Firewall/Internet Connection Sharing
(ICS) (SHAREDACCESS, StartMode='Automatic')
20125 14:34:30 (0) ** - Exchange Management Service (MSEXCHANGEMGMT,
StartMode='Automatic')
20126 14:34:30 (0) ** => If the WMI service is stopped, the listed
service(s) will have to be stopped as well.
20127 14:34:30 (0) ** Note: If the service is marked with (*), it
means that the service/application uses WMI but
20128 14:34:30 (0) ** there is no hard dependency on WMI.
However, if the WMI service is stopped,
20129 14:34:30 (0) ** this can prevent the service/application
to work as expected.
20130 14:34:30 (0) **
20131 14:34:30 (0) ** RPCSS service:
..............................................................................
OK (Already started).
20132 14:34:30 (0) ** WINMGMT service:
............................................................................
OK (Already started).
20133 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20134 14:34:30 (0) ** WMI service DCOM setup:
.....................................................................
OK.
20135 14:34:30 (0) ** WMI components DCOM registrations:
.......................................................... OK.
20136 14:34:30 (0) ** WMI ProgID registrations:
................................................................... OK.
20137 14:34:30 (0) ** WMI provider DCOM registrations:
............................................................ OK.
20138 14:34:30 (0) ** WMI provider CIM registrations:
............................................................. OK.
20139 14:34:30 (0) ** WMI provider CLSIDs:
........................................................................
OK.
20140 14:34:30 (0) ** WMI providers EXE/DLL availability:
......................................................... OK.
20141 14:34:30 (0) ** - Started at 'Root'
--------------------------------------------------------------------------------
20142 14:34:30 (0) ** WMI ADAP status:
............................................................................
OK.
20143 14:34:30 (0) ** WMI CONNECTIONS:
............................................................................
OK.
20144 14:34:30 (0) ** WMI GET static operations:
.................................................................. OK.
20145 14:34:30 (0) ** WMI MOF representations:
.................................................................... OK.
20146 14:34:30 (0) ** WMI QUALIFIER access operations:
............................................................ OK.
20147 14:34:30 (0) ** WMI ENUMERATION operations:
................................................................. OK.
20148 14:34:30 (0) ** WMI EXECQUERY operations:
................................................................... OK.
20149 14:34:30 (0) ** WMI PUT operations:
.........................................................................
OK.
20150 14:34:30 (0) ** WMI DELETE operations:
......................................................................
OK.
20151 14:34:30 (0) ** WMI GET VALUE operations:
................................................................... OK.
20152 14:34:30 (0) ** WMI static instances retrieved:
............................................................. 781.
20153 14:34:30 (0) ** WMI dynamic instances retrieved:
............................................................ 0.
20154 14:34:30 (0) ** WMI instances request cancellations (to limit
performance impact): ......................... 0.
20155 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20156 14:34:30 (2) !! WARNING: Unexpected or missing registry key
values: ........................................ 1 WARNING(S)!
20157 14:34:30 (2) !! WARNING: - Unexpected registry key value:
20158 14:34:30 (0) ** - Current:
HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\Logging (REG_SZ) -> 2
20159 14:34:30 (0) ** - Expected:
HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\Logging (REG_SZ) -> 1
20160 14:34:30 (0) **
20161 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20162 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20163 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20164 14:34:30 (0) ** --------------------------------------- WMI
REPORT: END --------------------------------------------
20165 14:34:30 (0) **
----------------------------------------------------------------------------------------------------
20166 14:34:30 (0) **
20167 14:34:30 (0) ** WARNING: WMIDiag determined that WMI works
CORRECTLY. HOWEVER, some issues were detected. Check 'C:\DOCUMENTS
AND SETTINGS\SMARTINEZ38\LOCAL
SETTINGS\TEMP\WMIDIAG-V1.10_XP__.CLI.SP2.32_DISEPC026225_2006.10.17_14.29.37.LOG'
for details.
20168 14:34:30 (0) **
20169 14:34:30 (0) ** WMIDiag executed in 293 second(s).
20170 14:34:30 (3)
20171 14:34:30 (3) 1.10,10/17/2006,02:29:42 p.m.,10/17/2006 02:29:42
p.m.,False,False,False,32-bit,x86 Family 15 Model 2 Stepping 9
GenuineIntel,5.1,2600,Service Pack 2,Windows XP - Service pack 2 -
32-bit,XP__.CLI.SP2.32,00000409,DISEPC026225,UDEM\SMARTINEZ38,False,Root,IDE,0,0,0,0,
,8,25896,8,25877,0, ,
,0,3,0,0,0,15,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,
,0,781,0,2,23,0,10/17/2006,02:34:30
p.m.,80,2,9,293,42,2,2,WMIDIAG-V1.10_XP__.CLI.SP2.32_DISEPC026225_2006.10.17_14.29.37.LOG,C:\DOCUMENTS
AND SETTINGS\SMARTINEZ38\LOCAL
SETTINGS\TEMP\WMIDIAG-V1.10_XP__.CLI.SP2.32_DISEPC026225_2006.10.17_14.29.37.LOG
20172 14:34:30 (3)
20173 14:34:30 (0) ** WMIDiag v1.10 ended on Martes, 17 de Octubre de
2006 at 14:34 (W:42 E:2 S:2).
20174 14:34:30 (0) ** CSV file "C:\DOCUMENTS AND
SETTINGS\SMARTINEZ38\LOCAL
SETTINGS\TEMP\WMIDIAG-V1.10_XP__.CLI.SP2.32_DISEPC026225_2006.10.17_14.29.37-STATISTICS.CSV"
closed.
20175 14:34:30 (0) ** LOG file "C:\DOCUMENTS AND
SETTINGS\SMARTINEZ38\LOCAL
SETTINGS\TEMP\WMIDIAG-V1.10_XP__.CLI.SP2.32_DISEPC026225_2006.10.17_14.29.37.LOG"
closed.

Bkiddo · Oct 19, 2006

Help! any idea???

James Crosswell · Oct 24, 2006

Bkiddo said:
Help! any idea???

Anti-Virus software??? Do you have any installed (Norton/Symantec
security suites)? If so, can you temporarily disable it on the remote
machine to see if it is related to the error message you're getting?

Best Regards,

James Crosswell
Microforge.net LLC
http://www.microforge.net

Bkiddo · Oct 25, 2006

The XP machine could have Haury or Karpesky, but when it worked in the
past was even the AVs, suddenly it stoped working.

I applied the

EDI · Oct 25, 2006

at or near the end of the log there were these few lines :

20156 14:34:30 (2) !! WARNING: Unexpected or missing registry key
values: ........................................ 1 WARNING(S)!
20157 14:34:30 (2) !! WARNING: - Unexpected registry key value:

so something is wrong with the registry on the machine you ran that on

Jonathan Liu [MSFT] · Nov 3, 2006

Is the target\remote machine in a workgroup? If so you will need to make a
minor adjustment:

See this article:
http://support.microsoft.com/?kbid=290403

Please let me know if this resolves your issue.

DWAnderson · Nov 30, 2006

I have this issue too and not only get these access denied errors when
trying to access WMI remotely, but also get them when trying to do so
LOCALLY using WMIMGMT.MSC. Similar errors appear on all of the client PCs in
the domain (all running XP Pro), but I can access WMI on the SBS 2003 server
I am running both locally and from other PCs.

I have tried the same things as mentioned in the email staring this thread
and more:

1. The firewall is down.

2. Applied the commands:
netsh firewall set service RemoteAdmin enable
netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135

*** Although when doing so I received the following error each time:

"WARNING: Could not obtain host information from machine: [BABBIT]. Some
commands may not be available.
Access is denied."

3. Did the workaround suggested in:
http://support.microsoft.com/kb/909444

4. Ran the workaround in: http://support.microsoft.com/kb/884573

5. Added the account I use to access by Wbemtest with to the Default
Lauch Permissions with Full Control.

6. Checked up the registry
:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\forceguest
were set to 0.

7. Have tried restoring the repository.

8. Have verified I have correct DCOM settings.

9. Made sure the 'SERVICE' account was added to the 'Impersonate Client
after authentication' local policy.

10. Ran WMIDiag and the relevant portion of that log is as follows:

** Checking WMI namespace 'Root' (L=1).
..1136 01:35:26 (1) !! ERROR: (CheckWMIStaticData) : 0x80070005 - Access is
denied.
..1137 01:35:26 (0) ** Checking WMI ADAP status.
..1138 01:35:26 (1) !! ERROR: (GetADAPStatus) : 0x80070005 - Access is
denied.
..1139 01:35:26 (0) ** Checking WMI features.
..1140 01:35:26 (3) Opening WMI namespace 'Root'.
..1141 01:35:27 (1) !! ERROR: (CheckWMIFeatures) : 0x80070005 - Access is
denied.
..1142 01:35:27 (3) Opening WMI namespace 'Root/Default'.
..1143 01:35:27 (1) !! ERROR: (CheckWMIFeatures) : 0x80070005 - Access is
denied.
..1144 01:35:27 (3) Opening WMI namespace 'Root/CIMv2'.
..1145 01:35:27 (1) !! ERROR: (CheckWMIFeatures) : 0x80070005 - Access is
denied.
..1146 01:35:27 (3) Opening WMI namespace 'Root/WMI'.
..1147 01:35:27 (1) !! ERROR: (CheckWMIFeatures) : 0x80070005 - Access is
denied.
..1148 01:35:27 (0) ** Collecting inventory information.
..1149 01:35:27 (1) !! ERROR: (CheckInventory) : 0x80070005 - Access is
denied.
..1150 01:35:27 (0) ** Checking WMI Repository files presence.
..1151 01:35:27 (3) 'C:\WINDOWS\SYSTEM32\WBEM\Repository\FS' has a size of
7802548 bytes.

There were no other errors.

Over two nights of experiments I have exhausted the wisdom accessable by
searches of Google Groups, Google and Live Search.

Can anyone help?

DWAnderson · Dec 16, 2006

For the benefit of others that might have this problem in the future, I
solved this problem (at lease for now), but removing the PC from the domain
(by moving it to a workgroup) and then adding the PC back to the domain.

DWAnderson said:
I have this issue too and not only get these access denied errors when
trying to access WMI remotely, but also get them when trying to do so
LOCALLY using WMIMGMT.MSC. Similar errors appear on all of the client PCs
in the domain (all running XP Pro), but I can access WMI on the SBS 2003
server I am running both locally and from other PCs.

I have tried the same things as mentioned in the email staring this thread
and more:

1. The firewall is down.

2. Applied the commands:
netsh firewall set service RemoteAdmin enable
netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135

*** Although when doing so I received the following error each time:

"WARNING: Could not obtain host information from machine: [BABBIT]. Some
commands may not be available.
Access is denied."

3. Did the workaround suggested in:
http://support.microsoft.com/kb/909444

4. Ran the workaround in: http://support.microsoft.com/kb/884573

5. Added the account I use to access by Wbemtest with to the Default
Lauch Permissions with Full Control.

6. Checked up the registry
:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\forceguest
were set to 0.

7. Have tried restoring the repository.

8. Have verified I have correct DCOM settings.

9. Made sure the 'SERVICE' account was added to the 'Impersonate Client
after authentication' local policy.

10. Ran WMIDiag and the relevant portion of that log is as follows:

** Checking WMI namespace 'Root' (L=1).
.1136 01:35:26 (1) !! ERROR: (CheckWMIStaticData) : 0x80070005 - Access is
denied.
.1137 01:35:26 (0) ** Checking WMI ADAP status.
.1138 01:35:26 (1) !! ERROR: (GetADAPStatus) : 0x80070005 - Access is
denied.
.1139 01:35:26 (0) ** Checking WMI features.
.1140 01:35:26 (3) Opening WMI namespace 'Root'.
.1141 01:35:27 (1) !! ERROR: (CheckWMIFeatures) : 0x80070005 - Access is
denied.
.1142 01:35:27 (3) Opening WMI namespace 'Root/Default'.
.1143 01:35:27 (1) !! ERROR: (CheckWMIFeatures) : 0x80070005 - Access is
denied.
.1144 01:35:27 (3) Opening WMI namespace 'Root/CIMv2'.
.1145 01:35:27 (1) !! ERROR: (CheckWMIFeatures) : 0x80070005 - Access is
denied.
.1146 01:35:27 (3) Opening WMI namespace 'Root/WMI'.
.1147 01:35:27 (1) !! ERROR: (CheckWMIFeatures) : 0x80070005 - Access is
denied.
.1148 01:35:27 (0) ** Collecting inventory information.
.1149 01:35:27 (1) !! ERROR: (CheckInventory) : 0x80070005 - Access is
denied.
.1150 01:35:27 (0) ** Checking WMI Repository files presence.
.1151 01:35:27 (3) 'C:\WINDOWS\SYSTEM32\WBEM\Repository\FS' has a size
of 7802548 bytes.

There were no other errors.

Over two nights of experiments I have exhausted the wisdom accessable by
searches of Google Groups, Google and Live Search.

Can anyone help?

Infameous 0x80070005 ERROR: Access denied

Bkiddo

James Crosswell

EDI

Bkiddo

Bkiddo

James Crosswell

Bkiddo

EDI

Jonathan Liu [MSFT]

DWAnderson

DWAnderson