topic Re: Cisco Context Directory Agent - Error Querying for WMI prope in Network Access Control

Cisco Context Directory Agent - Error Querying for WMI property

Simon Ludovic — Mon, 11 Mar 2019 02:11:14 GMT

Hello.

I'm trying to connect Cisco CDA with Windows 2008 R2 Domain Controller but I get this error:

Log attributes

wmi-property

exception-stack

org.jinterop.winreg.smb.JIWinRegStub.winreg_CreateKey(JIWinRegStub.java:310)

org.jinterop.dcom.core.JIComServer.initialise(JIComServer.java:510)

org.jinterop.dcom.core.JIComServer.(JIComServer.java:414)

com.cisco.cda.rt.adobserver.adobserver.jinteropUtil.getWmiLocator(jinteropUtil.java:39)

com.cisco.cda.rt.adobserver.adobserver.EventsThread.QueryWMIProperty(EventsThread.java:83)

com.cisco.cda.rt.adobserver.adobserver.EventsThread.getNetBIOS(EventsThread.java:171)

com.cisco.cda.rt.adobserver.adobserver.EventsThread.extractDCData(EventsThread.java:203)

com.cisco.cda.rt.adobserver.adobserver.EventsThread.run(EventsThread.java:599)

dc-hostname

HOSTANEM/192.168.X.X

dc-name

HOSTNAME

exception-cause

org.jinterop.dcom.common.JIRuntimeException: Access is denied, please check whether the [domain-username-password] are correct. Also, if not already done please check the GETTING STARTED and FAQ sections in readme.htm. They provide information on how to correctly configure the Windows machine for DCOM access, so as to avoid such exceptions. [0x00000005]

wmi-class

Win32_NTDomain

exception-message

Access is denied, please check whether the [domain-username-password] are correct. Also, if not already done please check the GETTING STARTED and FAQ sections in readme.htm. They provide information on how to correctly configure the Windows machine for DCOM access, so as to avoid such exceptions. [0x00000005]

wmi-property

DomainName

dc-username

administrator

Cisco Context Directory Agent - Error Querying for WMI property

Christian Siedschlag — Tue, 12 Jun 2012 13:24:12 GMT

I get the same error, in AD Agent this collect works fine. (same user)

Cisco Context Directory Agent - Error Querying for WMI property

Simon Ludovic — Tue, 12 Jun 2012 13:31:14 GMT

Yes indeed.

The AD Agent from both DC's works fine to me also... I think because they are made for Microsoft environment.

With CDA it's another problem because I suppose that is a Linux kernel.

Cisco Context Directory Agent - Error Querying for WMI property

eshabat — Tue, 12 Jun 2012 15:37:31 GMT

Hi guys,

On Windows 2008 R2 only, the Cisco CDA requires the user to have an additional permission on the following registry key:

–HKLM\Software\Classes\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}

–HKLM\Software\Classes\Wow6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6} (only if this key exists)

This permission is not given to members of the Domain Admins by default, and must be added explicitly.

You can refer to the user guide for more information:

http://www.cisco.com/en/US/docs/security/ibf/cda_10/Install_Config_guide/cda_wrkng.html#wp1054050

I hope this helps resolves your issue,

Erez

Cisco Context Directory Agent - Error Querying for WMI property

Simon Ludovic — Thu, 14 Jun 2012 06:06:07 GMT

Hi Shabat,

Sorry for my late answer.

I tried to modify the registry's as you said but I'm getting the error "Unable to save permission changes on

{76A64158-CB41-11D1-8B02-00600806D9B6}. Access is denied."

I forgot to mention that our DC's has Win 2008 R2 x64 SP1.

Regarding the privileges, the admin account has full access, but the permissions cannot be changed..

I don't know how to solve it.

Thanks in advance.

Regards,

Simon

Cisco Context Directory Agent - Error Querying for WMI property

eshabat — Thu, 14 Jun 2012 07:11:01 GMT

Hi Simon,

You will need a Domain Admin account to add the permisson.

If you are indeed using a Domain Admin account, and still get the "Access is denied" message, you will need to take ownership of the registery key(s). You can do this by clicking the Advanced button in the Permissions tab - this will open a new window, in that window go to the "Owner" tab, and change the owner to the Domain Administrators group, or your current administrator account.

After taking ownership, you should be able to change the permissions successfully (without getting an "Access is denied" message).

Please let me know how it goes.

Thanks,

Erez

Cisco Context Directory Agent - Error Querying for WMI property

Simon Ludovic — Thu, 14 Jun 2012 07:22:44 GMT

Hy Erez,

Thanks for reply.

So...

1. My user it's the domain admin

2. The ownership of the registry is already my domain admin.

But still not working.

Cisco Context Directory Agent - Error Querying for WMI property

eshabat — Thu, 14 Jun 2012 11:21:24 GMT

Hi Simon,

Can you please double check the owner of the following key(s) explicitly? (i.e right click the key, click permissions and then advanced)

HKLM\Software\Classes\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}

HKLM\Software\Classes\Wow6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6} (only if this key exists)

By default the owner is "TrustedInstaller", and should be changed to Domain Admins.

If you are still getting an "Access is denied" message, please feel free to contact me and I'll guide you through it.

Thanks,

Erez

“sudo yum install openmotif22-2.2.3-18.i386”

Cisco Context Directory Agent - Error Querying for WMI property

Simon Ludovic — Thu, 14 Jun 2012 11:48:42 GMT

Hi Erez,

Finally works. Thank a lot.

But... I still have a question.

In this moment our DC's provides info's regarding the identity users to the main Cisco ASA and Irnport WSA S170 through Cisco AD Agent.

What I must do in order that ASA and WSA will comunicate with Cisco CDA instead of Cisco AD Agent to receive the updates?

Thanks again.

Regards,

Simon.

Cisco Context Directory Agent - Error Querying for WMI property

Simon Ludovic — Thu, 14 Jun 2012 12:22:41 GMT

Hi Erez,

I solved the problem also with connection between AD to ASA and WSA.

Thanks a again for help.

Regards,

Simon

Re: Cisco Context Directory Agent - Error Querying for WMI prope

tressmeister — Thu, 21 Jun 2012 20:09:17 GMT

Hi,

I had the same problem since I did not want to use a Domain Admin account.

I migrated from the original IDFW agent, original permissions were OK but it seems some permissions were still missing.

Here's what did the trick for me:

Start - Run - dcomcnfg

Then go to:

Component Services - Computers - My Computer - DCOM Config - {76A64158-CB41-11D1-8B02-00600806D9B6}

left-click Properties - Security tab - Edit ("Launch and Activation Permissions" and "Access Permissions") - add the permissions for the user (I added full permissions).

I'm using Windows Server 2008 R2.

Regards,

Claude

Print Screen attached.

Re: Cisco Context Directory Agent - Error Querying for WMI prope

CSCO11496083 — Mon, 09 Jul 2012 15:05:37 GMT

Hi,

I applied the solutions mentioned above, but now i get the below error. Domain still shows as down.

wmi-property	exception-stack	org.jinterop.dcom.core.JIRemUnknownServer.call(JIRemUnknownServer.java:158)
		org.jinterop.dcom.core.JIRemUnknownServer.addRef_ReleaseRef(JIRemUnknownServer.java:181)
		org.jinterop.dcom.core.JISession.releaseRef(JISession.java:805)
		org.jinterop.dcom.core.JIComServer.createInstance(JIComServer.java:777)
		com.cisco.cda.rt.adobserver.adobserver.jinteropUtil.getWmiLocator(jinteropUtil.java:40)
		com.cisco.cda.rt.adobserver.adobserver.EventsThread.QueryWMIProperty(EventsThread.java:83)
		com.cisco.cda.rt.adobserver.adobserver.EventsThread.getNetBIOS(EventsThread.java:171)
		com.cisco.cda.rt.adobserver.adobserver.EventsThread.extractDCData(EventsThread.java:203)
		com.cisco.cda.rt.adobserver.adobserver.EventsThread.run(EventsThread.java:599)
	dc-hostname	/

	dc-name
	exception-cause	java.net.ConnectException: Connection timed out

	wmi-class	Win32_NTDomain
	exception-message	An internal error occurred. [0x8001FFFF]

	wmi-property	DomainName
	dc-username

Any Idea on the error?

Thanks.

Re: Cisco Context Directory Agent - Error Querying for WMI prope

WALTER GROSSENBACHER — Fri, 20 Jul 2012 07:25:35 GMT

I have questions about the additional permissions you mentioned before. Our cda user is defined as domain admin and we changed the owner of the keys from TrustedInstaller to "Domain Admins".

What additional permissions are needed to get it working. We still have the problem that we get the "Access is denied". The same user used with the AD Agent works fine.

Thanks for helping in adv.

Walter

Sent from Cisco Technical Support iPad App

Re: Cisco Context Directory Agent - Error Querying for WMI prope

Simon Ludovic — Fri, 20 Jul 2012 07:35:10 GMT

Hy Walter,

All what I've done was to make stept by step what Erez told me to do. And it's working fine.

Only one thing... I'm didn't create a CDA Admin inserted on Domains Admins I'm using only the Domain administrator to let CDA connect to DC's.

Did you made also what Erez told me about in the message on Jun 14, 2012 1:21 PM (in response to Simon Ludovic)?

*** By default the owner is "TrustedInstaller", and should be changed to Domain Admins. *** cf. Erez... both registry must be changed.

Thanks.

Re: Cisco Context Directory Agent - Error Querying for WMI prope

WALTER GROSSENBACHER — Fri, 20 Jul 2012 08:06:37 GMT

Hi Simon,

We did change both registry entries.

The problem we have, that we don't know what additional permissions are needed. Can you provide an example or even better a printscreen of your permission settings? Thanks!

Walter

Sent from Cisco Technical Support iPad App

Re: Cisco Context Directory Agent - Error Querying for WMI prope

Simon Ludovic — Fri, 20 Jul 2012 08:13:06 GMT

Hy Walter,

Give me some minutes and I will provide some printscreens.

Thanks.

Re: Cisco Context Directory Agent - Error Querying for WMI prope

Simon Ludovic — Fri, 20 Jul 2012 08:21:05 GMT

So...

Please find attached a print screen from one DC and one registry (as example).

This settings I made on both DC's and on bot registry which Erez specified.

I would like to say that my DC's has Windows 2008 R2 SP1 x64.

Hope that this image helps you.

Re: Cisco Context Directory Agent - Error Querying for WMI prope

Simon Ludovic — Fri, 20 Jul 2012 08:23:36 GMT

By the way...

Firewall is permitting request from CDA to DC's?

It came in my mind the question.

It happens to me sometimes that I forgot to allow the traffic.

Re: Cisco Context Directory Agent - Error Querying for WMI prope

WALTER GROSSENBACHER — Fri, 20 Jul 2012 08:38:18 GMT

Hi Simon,

Thanks for the printscreen.

We already checked the firewalls. Everything ok.

The permissions and everything configured the same way but it doesn't work.

I doublecheck all the configurations again and check the logs to find out why it's not working.

Thanks again.

P.S. You have to check your printscreen. Maybe you wonna hide more informations....

Cheers

Walter

Sent from Cisco Technical Support iPad App

Re: Cisco Context Directory Agent - Error Querying for WMI prope

Simon Ludovic — Fri, 20 Jul 2012 08:58:53 GMT

Hy Walter,

I attached also a printscreen with config of DC's in Cisco CDA.

Maybe helps.

Schönes wochenende

Regards,

Simon