How do I configure Windows PCs for WMI access?

Configuration Overview

To configure DCOM on all Windows Client Systems from Windows 7 on, administrators must complete the following steps:

1. Verify the required services are enabled and configured to start automatically when the operating system boots.
2. Enable DCOM
3. Configure DCOM communications
4. Configure User Accounts for DCOM
5. Configure Windows Firewall
6. Configure WMI

Required DCOM and WMI services

The following Windows services must be started and configured for automatic startup on the system:

• Server
• Remote Registry
• Windows Management Instrumentation

The procedure below outlines the steps required to configure the Server, Remote Registry, and WMI services for automatic startup.

1. On your desktop, select Start > Run.
2. Type the following: msc
3. Click OK.
4. In the details pane, verify the following services are started and set to automatic startup:
   a. Server
   b. Remote Registry
   c. Windows Management Instrumentation
5. To change a service property, right-click on the service name, and then click Properties.
6. From the Startup type list box, select Automatic.
7. If the Service status is not started, click Start.
8. Click OK.
9. Close the Services window.

You are now ready to enable DCOM.

Enabling DCOM

1. On your desktop, select Start > Run.
2. Type the following: dcomcnfg
3. Click OK. The Component Services window is displayed.
4. Under Component Services, expand Computers, and then click My Computer.
5. On the Action menu, click Properties.
6. Select the Default Properties
7. Configure the following Default Properties:
   a. Select the Enable Distributed COM on this computer check box.
   b. Using the Default Authentication Level list box, select Connect.
   c. Using the Default Impersonation Level list box, select Identify.
8. Click OK.

You are now ready to configure the DCOM protocol.

Configuring DCOM communications

1. From the DCOM Configuration (dcomcnfg) window, expand Component Services, expand Computers, and select My Computer.
2. On the Action menu, click Properties.
3. Select the Default Protocols
4. Configure the following options:
   a. If Connection-oriented TCP/IP is listed in the DCOM Protocols window, go to Step 5.
   b. If Connection-oriented TC/IP is not listed in the DCOM Protocol window, select Add.
   c. From the Protocol Sequence list box, select Connection-oriented TC/IP.
5. Click OK.

You are now ready to configure a user account with permission to access DCOM.

Configuring user accounts for DCOM

After you have enabled DCOM, you must assign an account the proper permission to access DCOM on the host. You must select an existing account with administrative access or create a normal user account that is a member of an administrative group to access the host. The user you grant DCOM permissions is the user you must configure in the Asset Discovery WMI section.

1. From the DCOM Configuration (dcomcnfg) window, expand Component Services, expand Computers, and select My Computer.
2. On the Action menu, click Properties.
3. Select the COM Security
4. In Access Permissions, click Edit Default.
5. Select the user or group requiring DCOM access.
6. Configure the following user permissions:
   a. Local Access - Select the Allow check box.
   b. Remote Access - Select the Allow check box.
7. Click OK. The My Computer Properties window is displayed.
8. In Launch and Activation Permissions, click Edit Default.
9. Select the user or group requiring DCOM access.
10. Configure the following user permissions:
    a. Local Launch - Select the Allow check box.
    b. Remote Launch - Select the Allow check box.
    c. Local Activation - Select the Allow check box.
    d. Remote Activation - Select the Allow check box.
11. Click OK.
12. Close the Component Services window.

You are now ready to configure the Windows firewall to allow DCOM communications.

Configuring the Windows Firewall

If a firewall is located between the your Windows system and Asset Discovery, you must configure the firewall with an exception to permit DCOM communications.

Note: You must be an administrator to change Windows Firewall settings or add an exception to the Windows Firewall.

1. On your desktop, select Start > Run.
2. Type the following: msc.
3. Click OK.
4. Select Inbound Rules.
5. On the Action menu, click New Rule.
6. Select Custom and click Next. The Program window is displayed.
7. Select All programs, and click Next. The Protocol and Ports window is displayed.
8. From the Protocol type list box, select TCP and click Next.
   Note: We recommend you do not limit Local and Remote ports or local IP addresses, but define firewall connection rules by remote IP address.
9. Under Which remote IP addresses does this rule apply to?, select These IP addresses.
10. Select These IP addresses, click Add. The IP Address window is displayed.
11. In the This IP address or subnet text box, type the IP address of Asset Discovery, click OK. The Action window is displayed.
12. Select Allow the connection, click Next.
13. Type the network profile to which the rule applies, click Next.
14. Type a name and description for the firewall rule, click Finish.
15. Close the Server Manager window.

You are now ready to configure Windows Management Instrumentation (WMI).

Configuring WMI user access

The user or group you configured for DCOM access must also have Windows Management Instrumentation (WMI) permission to access the Windows event logs.

1. On your desktop, select Start > Run.
2. Type the following: msc
3. Click OK.
4. Right-click on WMI Control (Local), select Properties. The WMI Control (Local) Properties window is displayed.
5. Click the Security
6. In Namespace navigation, expand Root, click CIMV2.
7. Click Security on the bottom right. The Security for ROOT\CIMV2 window is displayed.
8. Select the user or group requiring WMI access.
9. Select the check boxes to add the following permissions:
   a. Execute Methods - Select the Allow check box.
   b. Provider Write - Select the Allow check box.
   c. Enable Account - Select the Allow check box.
   d. Remote Enable - Select the Allow check box.
   Note: If the user or group you are configuring is a system administrator, the allow permission check boxes might be selected as the permissions are inherited.
10. Click OK.
11. Close the WMIMGMT - WMI Control (Local) window.

Testing the connection

In order to test if WMI access is configured properly you can use the WBEMTEST tool by Microsoft that is already installed on your PC. You can launch it by opening a command line window and then call WBEMTEST.EXE. For more information on WBEMTEST check https://docs.microsoft.com/en-us/mem/configmgr/develop/core/understand/introduction-to-wbemtest.

Note that you must launch WBEMTEST on the PC where you intend to install OTbase Asset Discovery in order for the test to be meaningful.