Why is it important to Become Familiar with WMI Troubleshooting? Pt. 1

  • Article

Often in Virtualization and Management Products like SCVMM, MED-V, Config Manager, UE-V, and App-V the symptom of an issue appears in the respective System Center or MDOP product but the root cause is often caused by an anomaly in an underlying operating system component. Often that component is WMI. For this reason, it is invaluable have a solid understanding of WMI and WMI troubleshooting. WMI is often a component that can cause problems due to one or more of the following WMI issues:

  • Corrupted repository
  • Incomplete namespace
  • Access Denied
  • Invalid String in WMI property/data
  • Unexpected value
  • Memory leak
  • Code Defect by WMI Provider

One of the most common errors encountered is error 0x800706BA – RPC Server Unavailable.

This error has context. If it is during connecting to a WMI namespace, it is usually because:

  • The machine does not exist. 
  • The machine cannot respond because the appropriate firewall exceptions have not been made. Check firewall settings.

If it is during operation, it is likely because:

  • The client machine doesn’t have correct firewall settings for asynchronous call backs. 
  • Connecting to a machine which doesn’t exist.

First I would verify the firewall rules. I would make sure the following rules are set:

  • WMI (ASync) Properties – In Program: %SYSTEMROOT%\System32\WBEM\unsecapp.exe
  • WMI (DCOM) – In Port: TCP 135 Program: %SYSTEMROOT%\System32\svchost.exe
  • WMI (WMI) In-Out Program: %SYSTEMROOT%\System32\svchost.exe

I deal with WMI problems all the time. I generally follow this little troubleshooting checklist for RPC errors:

  1. Use the WMI Control MMC (WMIC.MSC) to ensure that the service is working on the local system.
  2. If the problem involves communicating with a remote system then use the WMI Control to test the ability to connect to the remote system
  3. For Access Denied type issues verify that the DCOM and WMI Service settings are at default values, and the Network Service account has been granted impersonation rights.
  4. Check the service settings if the WMI service fails to start or if client programs cannot communicate with the service. In some cases you may need to reregister all the modules to recover the service.