[ZBX-21710] Cannot execute WMI query: Windows reports too low authentication level for Zabbix Created: 2022 Sep 30  Updated: 2022 Oct 24

Status: Confirmed
Project: ZABBIX BUGS AND ISSUES
Component/s: Server (S)
Affects Version/s: 5.0.28
Fix Version/s: None

Type: Incident report Priority: Trivial
Reporter: Karlo Roberto Torio Assignee: Zabbix Development Team
Resolution: Unresolved Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified


 Description   

Zabbix server was unable to collect data because Microsoft did some hardening for DCOM and this changes are now enabled by default.

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

I have looked around the knowledge base and google search and nothing came up.  I wonder if you have encountered this already and created a KB article or patch somewhere. 

Steps to reproduce:

  1. create external check script to use WMI to fetch info
  2. create item 
  3. attempt to fetch item data

Sample WMI query:

SELECT ProcessId, CommandLine FROM Win32_Process WHERE Name like '%java%' AND CommandLine like '%services=%'

Result:

WMI Query Failed

ERROR: Login to remote object.\n\n\n STDERR:\nNTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied\n",), <traceback object at 0x7fab79734688>)

Expected:
No more WMI query errors



 Comments   
Comment by Karlo Roberto Torio [ 2022 Oct 24 ]

Hello, any updates?

Generated at Sun Jun 01 11:48:48 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.