Announcement

Collapse
No announcement yet.

0x80070005 error on some computers

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • 0x80070005 error on some computers

    Hello

    I get access denied error 0x80070005 when performing any WMI query or start process on a few computers. The common thing with these computers are that I am administrator through domain admins on these computers, they are running xp pro sp2 fully patched and a policy to turn off firewall, the remote registry service is on and no restriction in policy regarding connecting over network is in place. The WMI services are running.

    I can start and stop services, see shares and other things.

    I have searched through this nice forum and tested a command line for the firewall, checking with logon as with a few other accounts such as local administrator etc.

    This drives me nuts =)

    What things are required to run to make this work? At some other computers I also get an error that the computer is not configured for transactions, when trying to access shares.

    Any help is appreciated.

    /Andreas


    //edit - I checked from XP and Win2003 and same result.


    [This message has been edited by Gurk (edited 02-15-2005).]

  • #2
    Re: 0x80070005 error on some computers

    Not sure unfortunately because Hyena has no control over this. If you were to download CIM Studio from Microsoft's site you should see the same results.

    One thing that might be worth a test would be to run it locally on one of these computers to see if you can get WMI information. This might help determine if it has to do with accessing WMI remotely.

    Comment


    • #3
      Re: 0x80070005 error on some computers

      Try running dcomcnfg and right click on My Computer and then select Properties. Check the Default Properties and COM Security tabs and see if anything looks 'not right'. The best way to verify what the setting should be would be to run on a computer where this works and compare the results to one that does not. Unfortunately, I think that this utility must be run locally on each computer.
      Kevin Stanush
      SystemTools Software Inc.

      Comment


      • #4
        Re: 0x80070005 error on some computers

        Yessssss!!!!

        I got it to work, it sure was DCOM that was being obnoxious! Let me take return your help with the story of what it was:

        Some time ago these computers seem to be infected with "r.bot" trojan/virus. The virus didnt do much besides scanning for cd-keys and stuff (or this is what i have been told). The virus was *not* discovered by the antivirus but instead a removal tool from an unnamed company was used. This tool removed the files, the registry changes except for these two:

        HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
        EnableDCOM = "N"

        HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\Lsa
        restrictanonymous = "dword:00000001"

        The darn virus increased the security (!) on the machine. I guess to cloak it from let say... tools usning DCOM =)

        I got on the track after noticing some strange behaviour with dcomcnfg and then checking helpdesk logs. SP2 was applied *after* the removal and had absolutely nothing to do with the problems I described.

        I can also confess that kicking the computers do not remedy nor help with this, but it feels much better.

        Many many thanks to you, I would *not* have fixed this at all on my own. You got one happy IT-department sitting over here giggeling again with Hyena in their hands.

        /Andreas

        [This message has been edited by Gurk (edited 02-15-2005).]

        Comment


        • #5
          Re: 0x80070005 error on some computers

          Gurk,

          I just want to thank you for supplying you results. You've saved me from a major headache, and I'm SOOO happy. In most of my scripts, I attempt a standard WMI connection. If that fails, I use an alternate moniker asking the user for a different set of credentials. If THAT fails, I'm screwed (WMI-wise). But here's how I dealt with the WMI error (or inability to connect):

          On Error Resume Next

          (second attempt to connect, this time with alternate credentials)
          Set objLocator = CreateObject("WbemScripting.SWbemLocator")

          Set objWMIService = objLocator.ConnectServer(strComputer,strNamespace, strUser,strPassword)

          If err.number <> 0 Then
          'Change DCOM Reg Key
          Dim objRegObjRegistry, objRemoteRegKeys, MsgRet, retPopup

          MsgRet = MsgBox ("There was an error connecting to " & UCASE(strComputer) & "." & vbCrLf & _
          "The reason for this could be that the credentials you entered were wrong or they have insufficient rights. " &_
          "If you are sure that the credentials you entered were correct and you have Admin rights on " & UCASE(strComputer) &_
          ", it's very possible that the remote system has had DCOM turned off. If you believe this is the case, and " &_
          "you wish to attempt to re-initialize DCOM on the remote system so this script will function correctly, " & _
          "please click 'Yes', otherwise select 'No'.",4,"Failed to connect to " & UCASE(strComputer))

          Select Case MsgRet
          Case "6" 'Yes
          Err.Clear
          Set objRegObjRegistry = CreateObject("RegObj.Registry")

          If Err.Number <> 0 Then ' a little error check, meaning the registry object editor isn't registered
          WshShell.Popup "You most likely have not installed the proper tools on this workstation to run this script. " & vbCrLf & vbCrLf & _
          "An attempt will now be made to install the proper tools to utilize this script.", 10, "Error - RegObj not installed"
          WshShell.Run """\\server\tools$\Hyena\Install Custom Hyena Tools.bat""",0,True
          '(for those wondering, this batch file loads all of our custom tools) WshShell.Popup "Please run this script again to ensure the tools installed properly. You must have" & _
          " administrative rights to install these tools, and to effectively run this script.", 10, "Tool installation complete"
          WScript.Quit
          End If
          ' if we made it this far, set the actual remote registry object
          Set objRemoteRegistry = objRegObjRegistry.RemoteRegistry(strComputer)
          ' assign the top key we're dealing With
          strRegKeyPath = "\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE"

          ' set the remote registy key
          Set strRemoteRegKey = objRemoteRegistry.RegKeyFromString(strRegKeyPath)

          strRegKeyName = "EnableDCOM"
          strRegKeyValue = "Y"
          strRegKeyType = "1"

          ' try adding the key
          strRemoteRegKey.Values.Add strRegKeyName, strRegKeyValue, strRegKeyType

          WshShell.Popup "reg error: " & Err.Number & vbCrLf & Err.Description,5 ' for testing/debugging

          If Err.Number = 35004 Or Err.Number = 35006 Then ' Key exists, so just change the value
          Dim strRemRegErr : strRemRegErr = True
          For Each objRemoteRegKeys In strRemoteRegKey.Values
          If UCASE(objRemoteRegKeys.Name) = UCASE(strRegKeyName) Then
          objRemoteRegKeys.Value = strRegKeyValue
          End If
          Next
          Elseif strRemRegErr <> True Then 'access denied, most likely
          WshShell.Popup "Failed to change the DCOM registry key on " & strComputer & ". You will need to " &_
          "manually change the following key:" & vbCrLf & vbCrLf & _
          "Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE" & vbCrLf & _
          "Key: EnableDCOM" & vbCrLf & _
          "Value: Y (the value is just the letter, not the word 'Yes'",0,"Failed to change registry key"
          WScript.Quit

          End If
          retPopup = WshShell.Popup ("DCOM Registry Key changed. To make this change take effect, the remote system must be "&_
          "restarted." & vbCrLf & vbCrLf & "Do you wish to restart the remote system? BEWARE, THIS WILL " &_
          "ONLY GIVE THE REMOTELY LOGGED ON USER 60 SECONDS BEFORE RESTART!! Please ensure the remote system " &_
          "is ready to be restarted",0,"DCOM Registry Key changed",4)

          ' here we use the good-ole shutdown command, since WMI won't do the trick
          If retPopup = 6 Then WshShell.Run "\\server\tools$\Hyena\tools\shutdown -r -m \" & strComputer &_
          " -t 60 -c ""Your system must be restarted. Please save your work!""",0,False

          Case "7" 'No
          WScript.Quit
          End Select
          WScript.Quit

          'On Error Resume Next
          'Key Name, Key Value, Type of Key (0-None {not defined}, 1-Reg_Sz, 2-Reg_Expand_Sz, 4-Reg_Dword, 7-Reg_Multi_Sz)
          'WScript.Echo strRegKeyName & vbCrLf & Err.Number
          End If


          Of course, I have to use the RegObj.dll file to access the registry, and the batch file loads and registers it on the local system running the script.

          But again, thanks for pointing out that key!!

          Joel

          Comment


          • #6
            Re: 0x80070005 error on some computers

            Hi everyone,
            Ive got the same problem on my local machine.

            Any help will be appriciated,
            Ron.

            Comment


            • #7
              Re: 0x80070005 error on some computers

              YOu can search google for WMI and this error code. One Microsoft article I found was here:
              http://support.microsoft.com/kb/909444
              Kevin Stanush
              SystemTools Software Inc.

              Comment


              • #8
                Re: 0x80070005 error on some computers

                Help appreciated. I received this 0x80070005 error and teh message that windows could not authenticate my logon id. Does anyone know a functional resolution without running the Windows Authentication WGAPluginInstall.exe or MGADiag.exe?

                Comment

                Working...
                X