Solved

CIM_Datafile remote procedure call failed

Posted on 2008-06-10
37
1,718 Views
Last Modified: 2012-04-17
I have some code to scan our servers for mdb files - it works on most of them, but a few are failing and I've been able to gather as much as:
The remote procedure call failed.
when it gets to the loop:   For Each objFile in colFiles

It's like the collection isn't properly initialized, although I know that these files exist...any ideas what could be causing the problem - seems to exist on about 1/3 of my servers...
Option Explicit

Dim strComputer : strComputer = "."

Dim objFSO : Set objFSO = CreateObject("Scripting.FileSystemObject")

Dim objWMI : Set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 

Dim colSet : Set colSet = objWMI.ExecQuery ("Select * From Win32_ComputerSystem")

Dim objItem, strSrvName
 

For each objItem in colSet

  strSrvName = objItem.Name

Next
 

Set colSet=Nothing
 

Dim objOut : Set objOut = objFSO.CreateTextFile("E:\Batch\" & strSrvName & "-db.xls")

objOut.Writeline "SERVER NAME" & vbtab & "CREATION" & vbTab & "ACCESSED" & vbtab & "MODIFIED" & vbTab & "FILE NAME" & vbtab & "FILE SIZE" & vbTab & "FULL PATH" & vbtab & "OWNER"

Dim colFiles:Set colFiles = objWMI.ExecQuery ("Select * from CIM_Datafile Where Extension ='mdb'")

ScanFiles (colFiles)

objOut.Close

Set objOut = Nothing

Set objWMI = Nothing

Set objFSO = Nothing

Set colFiles = Nothing

wscript.quit 
 

Sub ScanFiles (colFiles)

Dim objFile, strFileName, strOwner

  For Each objFile in colFiles

  On Error Resume Next

    strFIleName=LCase(objFile.Name)

      Dim colOwner:Set colOwner = objWMI.ExecQuery ("ASSOCIATORS OF {Win32_LogicalFileSecuritySetting=""" & Replace(objFile.Name, "\", "\\") & """}" & " WHERE AssocClass=Win32_LogicalFileOwner ResultRole=Owner")

      If Err.Number <> 0 Then objOut.WriteLine & Err.Number & ":" & Err.Description & vbTab & strFileName

      For Each objItem in colOwner

        strOwner = objItem.ReferencedDomainname & "\" & objItem.Accountname

        If Err.Number <> 0 Then objOut.WriteLine  Err.Number & ":" & Err.Description & vbTab & strFileName

      Next

      If strOwner="\" then strOwner="None Found"

      objOut.WriteLine strSrvName & vbTab & DateStringToDate(objFile.CreationDate) & vbTab & DateStringToDate(objFile.LastAccessed) & _

           vbTab & DateStringToDate(objFile.LastModified) & vbTab & objFile.FileName & "." & objFile.Extension & vbTab & FormatNumber(objFile.FileSize, 0, -1,, -1) & _

           vbTab & objFile.Name & vbTab & strOwner & " ")

        If Err.Number <> 0 Then objOut.WriteLine Err.Number & ":" & Err.Description & vbTab & strFileName

    On Error Goto 0

  Next

  On Error Goto 0

  objOut.WriteLine "Scan Complete"

End Sub

Open in new window

0
Comment
Question by:sirbounty
  • 19
  • 8
  • 6
  • +2
37 Comments
 
LVL 17

Expert Comment

by:Jared Luker
ID: 21751204
If you are running the script locally on the machine that your scanning, it should have nothing to do with RPC.  Am I missing something?
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21751342
It's running locally, yes...
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 21751390
And it works fine on some computers, but not on others?
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21751583
correct
0
 
LVL 65

Assisted Solution

by:RobSampson
RobSampson earned 250 total points
ID: 21755437
Hi sirbounty,

My guess is that it may be trying to access a drive that is unavailable.  I can't remember if CIM_DataFile is capable of scanning network drives that might happen to be mapped, but, let's try restricting it to a specific drive or two.....this will scan drives c and d....

Regards,

Rob.
Option Explicit

Dim strComputer : strComputer = "."

Dim objFSO : Set objFSO = CreateObject("Scripting.FileSystemObject")

Dim objWMI : Set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

 

Dim colSet : Set colSet = objWMI.ExecQuery ("Select * From Win32_ComputerSystem")

Dim objItem, strSrvName

 

For each objItem in colSet

  strSrvName = objItem.Name

Next

 

Set colSet=Nothing

 

Dim objOut : Set objOut = objFSO.CreateTextFile("E:\Batch\" & strSrvName & "-db.xls")

objOut.Writeline "SERVER NAME" & vbtab & "CREATION" & vbTab & "ACCESSED" & vbtab & "MODIFIED" & vbTab & "FILE NAME" & vbtab & "FILE SIZE" & vbTab & "FULL PATH" & vbtab & "OWNER"

Dim colFiles:Set colFiles = objWMI.ExecQuery ("Select * from CIM_Datafile Where (Drive='c:' Or Drive='d:') And Extension ='mdb'")

ScanFiles (colFiles)

objOut.Close

Set objOut = Nothing

Set objWMI = Nothing

Set objFSO = Nothing

Set colFiles = Nothing

wscript.quit 

 

Sub ScanFiles (colFiles)

Dim objFile, strFileName, strOwner

  For Each objFile in colFiles

  On Error Resume Next

    strFIleName=LCase(objFile.Name)

      Dim colOwner:Set colOwner = objWMI.ExecQuery ("ASSOCIATORS OF {Win32_LogicalFileSecuritySetting=""" & Replace(objFile.Name, "\", "\\") & """}" & " WHERE AssocClass=Win32_LogicalFileOwner ResultRole=Owner")

      If Err.Number <> 0 Then objOut.WriteLine & Err.Number & ":" & Err.Description & vbTab & strFileName

      For Each objItem in colOwner

        strOwner = objItem.ReferencedDomainname & "\" & objItem.Accountname

        If Err.Number <> 0 Then objOut.WriteLine  Err.Number & ":" & Err.Description & vbTab & strFileName

      Next

      If strOwner="\" then strOwner="None Found"

      objOut.WriteLine strSrvName & vbTab & DateStringToDate(objFile.CreationDate) & vbTab & DateStringToDate(objFile.LastAccessed) & _

           vbTab & DateStringToDate(objFile.LastModified) & vbTab & objFile.FileName & "." & objFile.Extension & vbTab & FormatNumber(objFile.FileSize, 0, -1,, -1) & _

           vbTab & objFile.Name & vbTab & strOwner & " ")

        If Err.Number <> 0 Then objOut.WriteLine Err.Number & ":" & Err.Description & vbTab & strFileName

    On Error Goto 0

  Next

  On Error Goto 0

  objOut.WriteLine "Scan Complete"

End Sub

Open in new window

0
 
LVL 67

Author Comment

by:sirbounty
ID: 21755461
Hey Rob - I can give it a try tomorrow, but I did have a prior version where I built a dictionary of just the local volumes.  I've since stripped that out, but hey - could be that I shot myself in the foot doing so...
0
 
LVL 65

Assisted Solution

by:RobSampson
RobSampson earned 250 total points
ID: 21755518
Maybe....can't quite remember.....also, where you have
Select * from CIM_Datafile

maybe change that to
Select Name from CIM_Datafile

so it doesn't pull too much data....

Regards,

Rob.
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21769289
With those changes, I get
The remote procedure call failed.
when iterating the collection (for each...)
and when trying to simply display the count property of the collection, returns:
 SWbemObjectSet: The remote procedure call failed.
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 21773965
Hmmm, strange....you said you're sure that there are MDB files there?

OK, so after this line:
Dim colFiles:Set colFiles = objWMI.ExecQuery ("Select * from CIM_Datafile Where (Drive='c:' Or Drive='d:') And Extension ='mdb'")


if you put
WScript.Echo TypeName(colFiles)

what value do you get?

On my system, the value is SWbemObjectSet whether the collection returns files or not....

And this does not cause an error when the query does not return any files, so I think the actualy error must be with the ExecQuery line that runs the query.....

If the following process still fails, then I'd say there's some WMI problem on the local computer...

Start - Run and type WBEMTest
Click connect
Assuming you are on the computer you want to search enter root\cimv2 in the namespace
Click Connect
Click Query
Paste this query into the box:
Select * from CIM_DataFile where Drive='C:' AND Extension = 'mdb'

and see what you get....

Rob.
0
 
LVL 1

Accepted Solution

by:
rkorinek earned 250 total points
ID: 21833022
Are  you on a large file server?  I have run into this problem when WMI runs out of memory processing a query that returns a large amount of data.  Unfortunately, I have not been able to find a method to manage the memory any better than a forward only recordset.
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21866194
Putting in some more tests, my output is now producing 3 instances of this error (with no other output):

424: Object Required

(in response to    If Err.Number <> 0 Then objOut.WriteLine Err.Number & ":" & Err.Description)
but objFile.Name appears to be blank..

msgbox " "
msgbox objFile.Name
msgbox " "

I only get the first and last msgbox popus...
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 21866408
turn off option explicit or make sure that every single variable you are using has been DIMed
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21866606
Not using it...
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 21866806
Your original code has Option Explicit on line 1.  Did you remove it?
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21867002
Oh - maybe I misunderstood.
With option explicit - nothing is flagged as undeclared.
How does removing it help (it's not in the current code).
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 21867105
It was just a troubleshooting/debugging suggestion.

If the script continues without it, then there is something that is missing somewhere.
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21868612
with opt exp, it did flag one undeclared item inside my loop/sub, but I corrected that.
It runs fine either way - but still returns the 3 object required errors noted above...
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21868682
Okay, I started back at square one and just tried the attached script.

It failed after a few moments with:

test.vbs(8, 1) (null): The remote procedure call failed.
strComputer = "."
 

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
 

Set colFiles = objWMIService.ExecQuery _

    ("Select * From CIM_DataFile Where Extension = 'mdb'")
 

For Each objFile in colFiles

    Wscript.Echo objFile.Name

Next

Open in new window

0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 67

Author Comment

by:sirbounty
ID: 21868737
Hmm - limiting it to drive C seems to work...but all mdb files on that drive are irrelevant...Must be something wrong with the ones on the drive I'm needing...any idea what it could be or how to track it down?
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 21869554
I'm not sure why you would be getting an RPC error on line 8 of the script above.  You are setting strComputer to "." (local) so it should not be trying to go over the network.  Weird stuff.

Since there is no need for RPC when you are dealing with files locally, that is probably why checking files on drive C works.

 How about mapping a drive to the location you are trying to work with and then using the mapped drive letter in the script instead of a remote WMI call?

0
 
LVL 65

Expert Comment

by:RobSampson
ID: 21870667
SirBounty, I'm not sure why this is happening either, but perhaps a workaround would be to parse the output of a DIR command?

Rob.
Set objShell = CreateObject("WScript.Shell")

strDrive = "D:"

strFileName = "*"

strExt = ".mdb"

strOutputFile = "FileList.txt"

strCommand = "cmd /c dir /s /b " & strDrive & strFileName & strExt & " > " & strOutputFile

objShell.Run strCommand, 0, True

Set objFSO = CreateObject("Scripting.FileSystemObject")

Const intForReading = 1

Set objFile = objFSO.OpenTextFile(strOutputFile, intForReading, False)

If Not objFile.AtEndOfStream Then

	arrFiles = Split(objFile.ReadAll, VbCrLf)

	objFile.Close

	Set objFile = Nothing

	objFSO.DeleteFile strOutputFile, True

	strDetails = Join(arrfiles, vbCrLf)

Else

	strDetails = "No files were found from the command" & VbCrLf & strCommand

End If

WScript.Echo strDetails

Open in new window

0
 
LVL 67

Author Comment

by:sirbounty
ID: 21873697
Hey gang - I'm not looking for a workaround as it would add a good deal more for subsequent processing (getting owner, file dates, etc).
Plus, I hate for something to beat me :^)
I'm currently narrowing the selection criteria to the four main parent folders and will continue weeding it down until I discover the culprit...
0
 
LVL 1

Expert Comment

by:rkorinek
ID: 21875705
Have you tried limiting your returned recordset to forward only?  For example..

Set colFiles = objWMIService.ExecQuery _
    ("Select * From CIM_DataFile Where Extension = 'mdb'",,48)
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21875798
Thought my original script did, but I just tried it and again it fails with the rpc error...weird...
0
 
LVL 1

Expert Comment

by:rkorinek
ID: 21879597
I still think you root problem is the size of the query.  I have gotten RPC errors when running large queries on large file servers.  Are the server all of the same size data wise?  This would also explain why your code runs fine on some servers, but not all of them.
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21880547
tough to say - but most are configured the same - I'll look deeper into it tomorrow to see if the failing ones show any similar setups
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 21880599
What does this give you?

Rob.
strComputer = "."

 

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

 

Set colFiles = objWMIService.ExecQuery _

    ("Select * From CIM_DataFile Extension = 'mdb'")

 

If colFiles.Count > 0 Then

	WScript.Echo "Files were found..."

	For Each objFile in colFiles

	    Wscript.Echo objFile.Name

	Next

Else

	WScript.Echo "No files were found."

End If

Open in new window

0
 
LVL 65

Expert Comment

by:RobSampson
ID: 21880604
Ooops, missed the WHERE....
strComputer = "."

 

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

 

Set colFiles = objWMIService.ExecQuery _

    ("Select * From CIM_DataFile WHERE Extension = 'mdb'")

 

If colFiles.Count > 0 Then

	WScript.Echo "Files were found..."

	For Each objFile in colFiles

	    Wscript.Echo objFile.Name

	Next

Else

	WScript.Echo "No files were found."

End If

Open in new window

0
 
LVL 67

Author Comment

by:sirbounty
ID: 21880632
If memory serves me, it was erroring out on the count property...I can get the exact error tomorrow though.
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21997721
Sorry for the delay Rob - that doesn't work either.  It also gives me remote procedure call failed...

But, I've given up - need to get rolling on this, so I'm moving to a slower recursive drive/folder loop to accomplish this.
Thanx for the attempts.
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21997750
Oddly enough though,
the wbemtest method worked...it returned 96 objects from drive G.  Weird, huh?
0
 
LVL 67

Author Comment

by:sirbounty
ID: 21997972
ah, but it doesn't without the drive filter... :(
0
 
LVL 67

Author Closing Comment

by:sirbounty
ID: 31465703
I went with the recursive fso solution...thanx for the help just the same.
I suspect that it's got more to do with permission problems where users have stripped admin & system rights from their folder.  I'll be testing that shortly and will post back, if that's the case...(the fso script does reveal some folders as permission denied on one of these servers).
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 22012050
Hi, that's not a bad idea...what happens if you recreate the admin share on the offending drive?  Does the IPC$ exist?

Rob.
0
 
LVL 67

Author Comment

by:sirbounty
ID: 22012282
recreate the admin share?  Not sure I follow...ipc$ does exist.
I thought it might be permissions, since the fso method found some problems, but I'm still not 100% certain, since there's one file that I couldn't alter - probably in use...
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 22012312
It's a fairly long shot.....but open Computer Management, go to System Tools --> Shared Folders --> Shares, and Stop Sharing the C$ share.  Then restart the Server services in Services and Applications.

It is definately a very strange problem......

Rob.
0
 

Expert Comment

by:i134786p
ID: 37857757
I had the same problem. adding the Drive = 'c:' fixes the problem.

Doesnt work: ("Select * from CIM_DataFile Where FileName = 'notepad'")

Doesnt work: ("Select * from CIM_DataFile Where FileName = 'notepad' and Drive = 'c'")

works!!!: ("Select * from CIM_DataFile Where Drive = 'c:' and FileName = 'notepad'")
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

In this tutorial I will show you how to provide a dynamic RTF document on your website generated with data from your database. For this tutorial you will need Microsoft Word or WordPad, WhizBase and Microsoft Access. In this tutorial I will show …
Deploying a Microsoft Access application in a Citrix environment is not difficult but takes a few steps. However, Citrix system people are often of little help, as they typically know next to nothing about Access. The script provided here will take …
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.
In this fifth video of the Xpdf series, we discuss and demonstrate the PDFdetach utility, which is able to list and, more importantly, extract attachments that are embedded in PDF files. It does this via a command line interface, making it suitable …

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now