Forum Discussion

Antony_Hawkins's avatar
7 years ago

Better Win_WMI_Access_Denied, with error code identification

Win_WMI_Access_Denied- identifies that a probably-windows device isn't giving up WMI data (auto properties and active discovery)

This scripted alternative version, Win_WMI_Access_Denied_ErrorCodes, parses the error code returned from the Windows devices and converts that to a human-friendly alert message to help identify the likely cause (DCOM permissions, Windows Firewall, etc).

As in Exchange it has AppliesTo of '!(system.sysinfo) && isDevice()' as the original DataSource has, i.e. only devices that have never returned data.

However, you could clone or change the datasource to apply to previously-working devices, all Windows devices, etc, such that if collection fails for any reason, alerts can be triggered.