Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-21710

Cannot execute WMI query: Windows reports too low authentication level for Zabbix

    XMLWordPrintable

Details

    • Incident report
    • Status: Confirmed
    • Trivial
    • Resolution: Unresolved
    • 5.0.28
    • None
    • Server (S)
    • None

    Description

      Zabbix server was unable to collect data because Microsoft did some hardening for DCOM and this changes are now enabled by default.

      https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

      I have looked around the knowledge base and google search and nothing came up.  I wonder if you have encountered this already and created a KB article or patch somewhere. 

      Steps to reproduce:

      1. create external check script to use WMI to fetch info
      2. create item 
      3. attempt to fetch item data

      Sample WMI query:

      SELECT ProcessId, CommandLine FROM Win32_Process WHERE Name like '%java%' AND CommandLine like '%services=%'

      Result:

      WMI Query Failed

      ERROR: Login to remote object.\n\n\n STDERR:\nNTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied\n",), <traceback object at 0x7fab79734688>)

      Expected:
      No more WMI query errors

      Attachments

        Activity

          People

            zabbix.dev Zabbix Development Team
            karlo.torio Karlo Roberto Torio
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: