This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hello,
i do WBEM test to remote server using administrator and WBEM result is ok, but why if i got 'Access Denied' if try connect using another account (in my case i use test account).
User 'Test' is member of administrator groups, so in my mind the WBEM test should be ok if i use this account.
Check your security eventlog for logon failures. (You may need to check your audit policy to verify that you are logging logon failures.)
I have 2 VM's that I play with. On one I tried to connect with my testuser and got this error.
I added that account to the administrators group and then it worked.
Then I was playing around and found that if I type in the wrong password, then I get the same error that you got.
Hello @MotoX80
in event viewer i got this message
Account logon successfully but WBEM test result is failed.
In the "Applications and services logs/Microsoft/Windows", check the WMI-Activity log.
That's weird. Was someone messing around with WMI on this machine?
Right click the WMI Control and select properties. Check the security for Root. Administrators have everything (except special access) checked.
Then check Root\CimV2. Note the gray vs blue boxes. That indicates that the permissions are inherited.
Do you have something different?
Hi @MotoX80
Here the permission, seems user 'test' which member of administrators group already have access.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Do you have network shares enabled? Open Powershell_ISE and run this script. First with your admin account, then with the test account. Does it list the test user in the administrators group?
$server = "jktveeam02"
$User = ".\admin"
$pswd = "admin"
$PWord = ConvertTo-SecureString -String $pswd -AsPlainText -Force # the account's password
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $User, $PWord
new-psdrive -Name 'B' -PSProvider FileSystem -Root "\\$server\c$" -Credential $credential
(get-childitem b:\ ).count
$group = Get-WmiObject -ComputerName $server -Credential $Credential win32_group -filter 'Name = "Administrators"'
$group.GetRelated('Win32_UserAccount') | Format-Table
remove-psdrive -Name 'B'
Hi @MotoX80
If i add user 'test' to security for ROOT\CIMV2 i able to access now.
So my question is why i should add this user, actually 'test' account is member of Administrators and administrator already have access.
Well, the obvious answer is that, for whatever reason, your server is not recognizing that account to be a member of the administrators group.
That was why I suggested trying to access the C$ share since that requires admin access. And to list the members of the Administrators group to verify that the account is there.
Have you rebooted recently? Do you have another server where you could create a test account and try it there? Or create a test2 account on this server and see if that can access WMI. Can you RDP to the server and logon with that account and perform admin level tasks?
Try adding the user to these groups.
Hi @MotoX80
User 'test' can access to the WMI after adding this user to the WMI security.
I try make account 'test2' and assign to administrator group then WMI is access denied, rebooting the server with no luck.
Trying access admin share c$ for both user (test and test2) still can't access.
It's strange why both users is not reflected as administrator even both user is member of administrator group.
RDP to the server and log on with the test account. Open a command prompt with "Run as administrator". You should get the UAC prompt where all you have to do is click on "Yes". If you are prompted for a userid, then that account is not in the admins group.
Try "whoami /groups" and look for builtin\administrators.
HI..
the cmd not prompt username when run as administrator, and here result of whoami
I'm sorry, I just don't know why your server is doing that.