AdvisorAdvisorI have managed to get it putting events in the WMI log and this is what I now see - I get lots of these as it’s trying to read each class.
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = <collectordevice>; User = <remotemachine>\<localaccount>; ClientProcessId = 7272; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_NetworkAdapterConfiguration; ResultCode = 0x80041004; PossibleCause = Unknown
Some of the show the result code in bold, others swap it out for 0x80041003, which is usually ‘access denied’. I currently don’t have UAC disabled. It is successfully using the creds in wmi.user and wmi.pass, with the .\ prefix.
The local account is currently a member of local Admin group.
