Antony_Hawkins
8 years agoEmployee
Better Win_WMI_Access_Denied, with error code identification
Win_WMI_Access_Denied- identifies that a probably-windows device isn't giving up WMI data (auto properties and active discovery)
This scripted alternative version, Win_WMI_Access_Denied_ErrorCodes, parses the error code returned from the Windows devices and converts that to a human-friendly alert message to help identify the likely cause (DCOM permissions, Windows Firewall, etc).
As in Exchange it has AppliesTo of '!(system.sysinfo) && isDevice()' as the original DataSource has, i.e. only devices that have never returned data.
However, you could clone or change the datasource to apply to previously-working devices, all Windows devices, etc, such that if collection fails for any reason, alerts can be triggered.
4CKLN2