Solved

WMI errors

Posted on 2008-10-03
5
3,721 Views
Last Modified: 2013-11-05
WMI errors are preventing me from loading SQL 2005 Express or SQL 2008 express.
 Several errors like those shown below-- DCOM security errors.
I tried following the instructions in WMIDIAG-- did not work.  Also eliminate the WBEM repository and had XP recreate it fresh-- these errors remained.
I don't see where Microsoft WBEM UnSecured Apartment appears in DCOM security-- don't see how to fix these

18139 23:24:48 (0) ** DCOM security for 'Microsoft WBEM UnSecured Apartment' (Launch & Activation Permissions): ........................... MODIFIED.
18140 23:24:48 (1) !! ERROR: Default trustee 'BUILTIN\ADMINISTRATORS' has been REMOVED!
18141 23:24:48 (0) **        - REMOVED ACE:
18142 23:24:48 (0) **          ACEType:  &h0
18143 23:24:48 (0) **                    ACCESS_ALLOWED_ACE_TYPE
18144 23:24:48 (0) **          ACEFlags: &h0
18145 23:24:48 (0) **          ACEMask:  &h1
18146 23:24:48 (0) **                    DCOM_RIGHT_EXECUTE
18147 23:24:48 (0) **
18148 23:24:48 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
18149 23:24:48 (0) **    Removing default security will cause some operations to fail!
18150 23:24:48 (0) **    It is possible to fix this issue by editing the security descriptor and adding the ACE.
18151 23:24:48 (0) **    For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
18152 23:24:48 (0) **
18153 23:24:48 (0) ** DCOM security for 'Microsoft WBEM UnSecured Apartment' (Launch & Activation Permissions): ........................... MODIFIED.
18154 23:24:48 (1) !! ERROR: Default trustee 'NT AUTHORITY\INTERACTIVE' has been REMOVED!
18155 23:24:48 (0) **        - REMOVED ACE:
18156 23:24:48 (0) **          ACEType:  &h0
18157 23:24:48 (0) **                    ACCESS_ALLOWED_ACE_TYPE
18158 23:24:48 (0) **          ACEFlags: &h0
18159 23:24:48 (0) **          ACEMask:  &h1
18160 23:24:48 (0) **                    DCOM_RIGHT_EXECUTE
18161 23:24:48 (0) **
18162 23:24:48 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
18163 23:24:48 (0) **    Removing default security will cause some operations to fail!
18164 23:24:48 (0) **    It is possible to fix this issue by editing the security descriptor and adding the ACE.
18165 23:24:48 (0) **    For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
18166 23:24:48 (0) **
18167 23:24:48 (0) ** DCOM security for 'Microsoft WBEM UnSecured Apartment' (Launch & Activation Permissions): ........................... MODIFIED.
18168 23:24:48 (1) !! ERROR: Default trustee 'NT AUTHORITY\SYSTEM' has been REMOVED!
18169 23:24:48 (0) **        - REMOVED ACE:
18170 23:24:48 (0) **          ACEType:  &h0
18171 23:24:48 (0) **                    ACCESS_ALLOWED_ACE_TYPE
18172 23:24:48 (0) **          ACEFlags: &h0
18173 23:24:48 (0) **          ACEMask:  &h1
18174 23:24:48 (0) **                    DCOM_RIGHT_EXECUTE
18175 23:24:48 (0) **
18176 23:24:48 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
18177 23:24:48 (0) **    Removing default security will cause some operations to fail!
18178 23:24:48 (0) **    It is possible to fix this issue by editing the security descriptor and adding the ACE.
18179 23:24:48 (0) **    For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
0
Comment
Question by:dakota5
  • 2
  • 2
5 Comments
 
LVL 22

Expert Comment

by:orangutang
ID: 22642630
I'm not sure what that means but have you tried the WMI Diagnosis Utility (http://www.microsoft.com/downloads/details.aspx?familyid=d7ba3cd6-18d1-4d05-b11e-4c64192ae97d&displaylang=en)
0
 

Author Comment

by:dakota5
ID: 22644974
Orangutang:  Yes, the WMI diagnosis utility is the wmidiag I refer to in the original questions.  In the output from wmidiag there are suggestions for correcting the errors, but they are sketchy and difficult to follow.  (I posted part of the output in the original question.)

The point of my question is for someone to translate into clear operational English the steps suggested by wmidiag.  I ran DCOMCNFG as suggested, but have no idea how to use it to make these corrections.

Perhaps I will get a response from someone with experience using dcomcnfg.
0
 
LVL 16

Assisted Solution

by:cantoris
cantoris earned 100 total points
ID: 22646404
I've read that WMIDiag is not SP3-aware so perhaps the results it is giving you are misleading?
What does the Event Log itself show when you try your install?

Open DCOMCnFg again and navigate to
Component Services - Computers - My Computer - DCOM Config
Answer "Yes" to any prompts that appear.
You ought to be able to find "Microsoft WBEM UnSecured Apartment" listed alphabetically in there.  Is that where you looked?
Presuming you find it, open its Properties and try setting the options on the Security tab to "Use Default".

The following page has loads of stuff you can try if WMI is really poorly:
http://windowsxp.mvps.org/repairwmi.htm
0
 

Accepted Solution

by:
dakota5 earned 0 total points
ID: 22675407
Cantoris:
There is no entry for "Microsoft WBEM UnSecured Apartment" anywhere in the DCOM Config list.
I did find a solution to the problem, though.
http://www.windows-tech.info/15/91555fe5c8df4ee9.php
This was provided by Microsoft to the user who posted it.  Not clear why it works for allowing sqlExpress 2005 and 2008 to load.
The following is all from that posting--
1. Add network service account to administrators group.
2. Add authenticated users to following registry keys:

* HKCR\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}
* HKCR\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
* HKLM\Software\Microsoft\WBEM\CIMOM                 I did not actually do this third registry fix

To do step 1, you go to Control Panel, User Accounts, Advanced tab, click Advanced button, and open Groups folder.

To do step 2, right click on those registry keys, click Permissions, and add Authenticated Users. I gave them Full Control permissions, but I'm not sure if that was necessary or not.

0
 
LVL 16

Expert Comment

by:cantoris
ID: 22676201
That was a very weird one!  Thanks for letting us know what fixed it.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Migration of Exchange mailbox can be done with the ExProfre.exe tool. But at times, when the ExProfre.exe tool migrates the Exchange Server user profile, it results in numerous synchronization problems. Synchronization error messages appear in the e…
Step by step guide to Clean and Sort your windows registry! Introduction: Always remember: A Clean registry = Better performance = Save your invaluable time In this article we're going to clear our registry manually! Yes, manually! The e…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now