Description
Resolving an issue of denied access to a Windows Server
Problem
Service Mapping cannot access a Windows Server.
Symptoms
At the end of the discovery and mapping process, Service Mapping displays the following error for a Windows Server:
At the end of the discovery and mapping process, Service Mapping displays the following error for a Windows Server:
Access is denied.
Possible Cause 1
Service Mapping cannot access a Windows Server, because credentials configured for this Windows Server in the ServiceNow platform are wrong.
Resolution 1
Verify that the user name and password for the Windows Server are correct:
- Log into the Windows Server that you must discover using remote desktop connection.
- If you fail to connect, the username and password for this Windows Server are wrong. Find out the correct credentials and configure them as described in the Service Mapping documentation. If you connect successfully, continue with this troubleshooting procedure.
Possible Cause 2
Service Mapping cannot access a Windows Server, because a user is not part of the local administrators group.
Resolution 2
Verify that this user is added to the local administrators group.
Possible Cause 3
Windows Management Instrumentation (WMI) is disabled or not configured properly on this Windows Server.
Resolution 3
Check that Windows Management Instrumentation (WMI) is enabled by performing the following steps:
- On the Windows Server, navigate to Start > Run.
- Enter wbemtest.
- Check that the Windows Management Instrumentation Tester application starts.
If it does, WMI is enabled. - In the Windows Management Instrumentation Tester window, click Connect.
- In the Connect window, leave the default values for Namespace and Credentials and click Connect.
- Click Query.
- In the Query window, enter the following WMI query:
Select * from Win32_ComputerSystem and click Apply. - Verify that you get a reply with the computer name.
Possible Cause 4
WMI-related service or services are disabled.
Resolution 4
Ensure that all WMI-related services can be started on demand:
- In the Windows Explorer, navigate to Server Manager.
- In the tree, select Configuration, right-click WMI Control, and select Properties.
- In the WMI Control Properties window, click Security.
- Click the Root folder and click Security.
- In the Security for Root window, click Advanced.
- In the Advanced Security Settings for Root window, double-click Administrators.
- In the Permission Entry for Root window, verify that all check boxes are selected.
- In the Server Manager, select Configuration > Services and verify that the status for the following services is not disabled:
- Remote Access Auto Connection Manager
- Remote Access Connection Manager
- Remote Procedure Call (RPC)
- Remote Procedure Call (RPC) Locator
- Remote Registry
- Server
- Windows Management Instrumentation
- Windows Management Instrumentation Driver Extensions
- WMI Performance Adapter
Possible Cause 5
Service Mapping cannot use credentials for this host, because the credentials were configured on the MID Server service, not in the Credentials module on the ServiceNow instance.
Resolution 5
Perform the following steps:
- Open the Windows Services console.
- Double-click the name of the relevant MID Server service for the MID Server used for the discovery.
- Select the Log On tab which shows the Domain User or Local Admin credentials configured for this MID Server service.
- Verify that these credentials allow you to access the Windows Server you are trying to discover.
- Configure the WMI Collector service to use the same credentials:
- In the Windows Services console, double-click the name of the relevant WMI Collector service.
- Select the Log On tab.
- Enter the Domain User or Local Admin credentials for for this WMI Collector service.
- Click OK.
Possible Cause 6
The EnableDCOM registry entry that controls the global activation and call policies is disable either on the MID Server or on the Windows Server.
Resolution 6
Perform the following steps both on the MID Server and on the Windows Server to verify that DCOM is enabled on both servers:
- Navigate to the registry.
- Check the following registry entry on both computers:
Key: HKEY LOCAL MACHINE\Software\Microsoft\Ole
Name: EnableDCOM
Type: REG_SZ
Data: Y
Possible Cause 7
Credentials on the target Windows Server have changed.
Resolution 7
Perform the following steps:
- Perform the horizontal discovery of this Windows Server with Discovery as described in Run Quick Discovery.
- Check the result of the horizontal discovery for this Windows Server.
- If the horizontal discovery failed, it means that the credentials configured for this Windows Server on the ServiceNow platform are not updated.
- Check the credentials on the Windows Server.
- Modify the credentials for this server on the ServiceNow platform as described in Windows credentials.
Possible Cause 8
Credentials used for discovery of this Windows Server do not contain the domain name.
Resolution 8
Perform the following steps:
- Navigate to MID Server > Credentials.
- Click the Windows credentials configured for the Windows Server you failed to access.
- Check that the Windows Server credentials contain the domain name. The domain name appears in front of the user name and is separated with blackslash (\).
4. If not, add the relevant domain name to the credentials. Use the domain name which allows you to access this Windows Server.