# Wmi access denied after that install windows cumulative update KB5014702 **URL:** \ **Category:** Tutorials and Guides\ **Created:** [June 21, 2022, 11:09am UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016 "2022-06-21T11:09:43Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![FiratAlkis](https://community.icinga.com/letter_avatar_proxy/v4/letter/f/c6cbf5/32.png) [@FiratAlkis](https://community.icinga.com/u/FiratAlkis)\ **Post date:** [June 21, 2022, 11:09am UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/1 "2022-06-21T11:09:43Z")
Hi all, check\_wmi\_plus returned the following error when our windows support team installed KB5014702 for windows servers We try this solution and problem is fixed. I hope it help those who have similar problems. [https://support.microsoft.com/en-us/topic/june-14-2022-kb5014702-os-build-14393-5192-e60ac0e1-44a4-49f9-871f-7c25eb0e5bb1](https://support.microsoft.com/en-us/topic/june-14-2022-kb5014702-os-build-14393-5192-e60ac0e1-44a4-49f9-871f-7c25eb0e5bb1) UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user’s access level is too low. Your Authentication File might be incorrectly formatted or inaccessible. Wmic error text on the next line. [param/loadparm.c:587:init\_globals()] Initialising global parameters [param/loadparm.c:2462:lp\_load()] lp\_load: refreshing parameters from /dev/null [param/params.c:556:pm\_process()] params.c:pm\_process() - Processing configuration file “/dev/null” [param/loadparm.c:2471:lp\_load()] pm\_process() returned Yes [param/loadparm.c:1343:lp\_add\_hidden()] adding hidden service IPC$ [param/loadparm.c:1343:lp\_add\_hidden()] adding hidden service ADMIN$ [auth/gensec/gensec.c:1229:gensec\_register()] GENSEC backend ‘sasl-DIGEST-MD5’ registered [auth/auth.c:447:auth\_register()] AUTH backend ‘winbind\_samba3’ registered [auth/auth.c:447:auth\_register()] AUTH backend ‘winbind’ registered [auth/auth.c:447:auth\_register()] AUTH backend ‘name\_to\_ntstatus’ registered [auth/auth.c:447:auth\_register()] AUTH backend ‘fixed\_challenge’ registered [auth/auth.c:447:auth\_register()] AUTH backend ‘unix’ registered [auth/auth.c:447:auth\_register()] AUTH backend ‘anonymous’ registered [auth/auth.c:447:auth\_register()] AUTH backend ‘sam’ registered [auth/auth.c:447:auth\_register()] AUTH backend ‘sam\_ignoredomain’ registered [auth/gensec/gensec.c:1229:gensec\_register()] GENSEC backend ‘krb5’ registered [auth/gensec/gensec.c:1205:gensec\_register()] gensec subsystem fake\_gssapi\_krb5 is disabled [auth/gensec/gensec.c:1229:gensec\_register()] GENSEC backend ‘schannel’ registered [auth/gensec/gensec.c:1229:gensec\_register()] GENSEC backend ‘spnego’ registered [auth/gensec/gensec.c:1205:gensec\_register()] gensec subsystem gssapi\_spnego is disabled [auth/gensec/gensec.c:1229:gensec\_register()] GENSEC backend ‘gssapi\_krb5’ registered [auth/gensec/gensec.c:1229:gensec\_register()] GENSEC backend ‘gssapi\_krb5\_sasl’ registered [auth/gensec/gensec.c:1229:gensec\_register()] GENSEC backend ‘ntlmssp’ registered [lib/com/dcom/main.c:528:dcom\_determine\_rpc\_binding()] Using binding ncacn\_ip\_tcp:server.domain [librpc/rpc/dcerpc\_connect.c:521:continue\_map\_binding()] Mapped to DCERPC endpoint 135 [lib/com/dcom/main.c:413:determine\_rpc\_binding\_continue2()] dcerpc\_ndr\_request\_recv returned NT\_STATUS\_OK [lib/com/dcom/main.c:417:determine\_rpc\_binding\_continue2()] IObjectExporter::ServerAlive returned NT\_STATUS\_OK [auth/kerberos/kerberos\_util.c:236:kinit\_to\_ccache()] kinit for xxx@DOMAIN failed (Cannot contact any KDC for requested realm: unable to reach any KDC in realm DOMAIN) [auth/credentials/credentials\_krb5.c:300:cli\_credentials\_get\_client\_gss\_creds()] Failed to get CCACHE for GSSAPI client: Cannot contact any KDC for requested realm [auth/gensec/gensec\_gssapi.c:354:gensec\_gssapi\_client\_start()] Cannot reach a KDC we require [auth/gensec/gensec.c:606:gensec\_start\_mech()] Failed to start GENSEC client mech gssapi\_krb5: NT\_STATUS\_INVALID\_PARAMETER [auth/ntlmssp/ntlmssp\_client.c:128:ntlmssp\_client\_challenge()] Got challenge flags: [auth/ntlmssp/ntlmssp.c:72:debug\_ntlmssp\_flags()] Got NTLMSSP neg\_flags=0x62898205 NTLMSSP\_NEGOTIATE\_UNICODE NTLMSSP\_REQUEST\_TARGET NTLMSSP\_NEGOTIATE\_NTLM NTLMSSP\_NEGOTIATE\_ALWAYS\_SIGN NTLMSSP\_NEGOTIATE\_NTLM2 NTLMSSP\_CHAL\_TARGET\_INFO NTLMSSP\_NEGOTIATE\_128 NTLMSSP\_NEGOTIATE\_KEY\_EXCH [auth/ntlmssp/ntlmssp\_client.c:242:ntlmssp\_client\_challenge()] NTLMSSP: Set final flags: [auth/ntlmssp/ntlmssp.c:72:debug\_ntlmssp\_flags()] Got NTLMSSP neg\_flags=0x60088205 NTLMSSP\_NEGOTIATE\_UNICODE NTLMSSP\_REQUEST\_TARGET NTLMSSP\_NEGOTIATE\_NTLM NTLMSSP\_NEGOTIATE\_ALWAYS\_SIGN NTLMSSP\_NEGOTIATE\_NTLM2 NTLMSSP\_NEGOTIATE\_128 NTLMSSP\_NEGOTIATE\_KEY\_EXCH [wmi/wmic.c:196:main()] ERROR: Login to remote object. NTSTATUS: NT\_STATUS\_ACCESS\_DENIED - Access denied Thanks 🙂 ---
**Author:** ![initnull](https://community.icinga.com/user_avatar/community.icinga.com/initnull/32/5677_2.png) [@initnull](https://community.icinga.com/u/initnull)\ **Post date:** [June 21, 2022, 2:18pm UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/2 "2022-06-21T14:18:21Z")
Same here. But what exactly did you do to fix it? Can’t see an obvious solution in the Link. ---
**Author:** ![FiratAlkis](https://community.icinga.com/letter_avatar_proxy/v4/letter/f/c6cbf5/32.png) [@FiratAlkis](https://community.icinga.com/u/FiratAlkis)\ **Post date:** [June 22, 2022, 6:45am UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/3 "2022-06-22T06:45:41Z")
how we fixed it I adding to the following: we set the value to 0 (disabled) ## Registry setting to enable or disable the hardening changes During the timeline phases in which you can enable or disable the hardening changes for [CVE-2021-26414](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26414), you can use the following registry key: - Path : HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat - Value Name: “RequireIntegrityActivationAuthenticationLevel” - Type: dword - Value Data: default = 0x00000000 means disabled. 0x00000001 means enabled. If this value is not defined, it will default to disabled. **Note** You must enter Value Data in hexadecimal format. **Important** You must restart your device after setting this registry key for it to take effect. **Note** Enabling the registry key above will make DCOM servers enforce an Authentication-Level of [RPC\_C\_AUTHN\_LEVEL\_PKT\_INTEGRITY](https://docs.microsoft.com/en-us/windows/win32/rpc/authentication-level-constants) or higher for activation. > **[KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass...](https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c)** ---
**Author:** ![gfcarvalho.rgk4it](https://community.icinga.com/letter_avatar_proxy/v4/letter/g/58956e/32.png) [@gfcarvalho.rgk4it](https://community.icinga.com/u/gfcarvalho.rgk4it)\ **Post date:** [June 22, 2022, 7:44am UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/4 "2022-06-22T07:44:04Z")
Hey, A new version of _check\_wmi\_plus_ will be release in a few weeks along with some improvements and the wmic (the package from linux) will not be used any more, solving this issue ‘permanently’… [https://edcint.co.nz/checkwmiplus/new-wmic-client-coming-soon/](https://edcint.co.nz/checkwmiplus/new-wmic-client-coming-soon/) In the mean time we end up using a python replacement for the linux wmic…: [https://github.com/simply42/check\_wmi\_plus\_wmic\_dropin](https://github.com/simply42/check_wmi_plus_wmic_dropin) There’s a ‘how to use’ section, in my case i also have: - Set python3 as ‘default version’ to be used (update-alternatives) - Installed _impacket_ with pip - Adjusted permission and group of `/usr/lib/python3.6/site-packages/` and `/usr/lib64/python3.6/site-packages/`… I hope this help ---
**Author:** ![initnull](https://community.icinga.com/user_avatar/community.icinga.com/initnull/32/5677_2.png) [@initnull](https://community.icinga.com/u/initnull)\ **Post date:** [June 22, 2022, 12:57pm UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/5 "2022-06-22T12:57:48Z")
Thanks for the info. So until March 14, 2023 resp. when a new wmic / check\_wmi\_plus is released at least I can continue with the old wmi. 🙂 ---
**Author:** ![picoroma](https://community.icinga.com/user_avatar/community.icinga.com/picoroma/32/2235_2.png) [@picoroma](https://community.icinga.com/u/picoroma)\ **Post date:** [July 21, 2022, 9:31am UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/6 "2022-07-21T09:31:08Z")
I tried to use the latest release of check\_wmi\_plus downloaded from here: [https://edcint.co.nz/checkwmiplus/version-1-67-released/](https://edcint.co.nz/checkwmiplus/version-1-67-released/) But this release introduce the concept of WMIC Server… Anybody have found a simply solution without use the WMIC Server on NAGIOS Host ? ---
**Author:** ![picoroma](https://community.icinga.com/user_avatar/community.icinga.com/picoroma/32/2235_2.png) [@picoroma](https://community.icinga.com/u/picoroma)\ **Post date:** [July 21, 2022, 1:35pm UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/7 "2022-07-21T13:35:27Z")
I’m having problem after applied this workaround: File “/bin/wmic”, line 50, in elif args.user is not None: AttributeError: ‘Namespace’ object has no attribute ‘user’ ---
**Author:** ![gfcarvalho.rgk4it](https://community.icinga.com/letter_avatar_proxy/v4/letter/g/58956e/32.png) [@gfcarvalho.rgk4it](https://community.icinga.com/u/gfcarvalho.rgk4it)\ **Post date:** [September 5, 2022, 11:58pm UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/8 "2022-09-05T23:58:11Z")
Hi! I’m testing the last release of check\_wmi\_plus too… i didn’t found a simple solution and i’m using the wmic\_server… the problem now is performance when a big number of requests is done at the same time, looks like some type of queue is done but this is related to gunicorn (used by the server daemon) and tuning is required, currently i’m running gunicorn with `--workers 4 --threads 4` but in some cases i’m still have problems… ---
**Author:** ![bisontim](https://community.icinga.com/letter_avatar_proxy/v4/letter/b/f17d59/32.png) [@bisontim](https://community.icinga.com/u/bisontim)\ **Post date:** [December 10, 2022, 8:01am UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/9 "2022-12-10T08:01:23Z")
> [@gfcarvalho.rgk4it](#): > > ing is required, currently i’m running gunicorn with `--workers 4 --threads 4` b I have problems with gunicorn too… After many requests it seems to hang. I read: Dec 10 08:35:07 nice[17683]: [2022-12-10 08:35:07 +0100] [17683] [CRITICAL] WORKER TIMEOUT (pid:20454) Dec 10 08:35:08 nice[17683]: ERROR:asyncio:Fatal error: protocol.data\_received() call failed. Dec 10 08:35:08 nice[17683]: protocol: \ So I don’t understand how to size gunicorn properly ---
**Author:** ![bisontim](https://community.icinga.com/letter_avatar_proxy/v4/letter/b/f17d59/32.png) [@bisontim](https://community.icinga.com/u/bisontim)\ **Post date:** [December 12, 2022, 7:36am UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/10 "2022-12-12T07:36:31Z")
I solved with --threads 10 No more performance problem ---
**Author:** ![picoroma](https://community.icinga.com/user_avatar/community.icinga.com/picoroma/32/2235_2.png) [@picoroma](https://community.icinga.com/u/picoroma)\ **Post date:** [October 2, 2023, 9:14am UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/11 "2023-10-02T09:14:23Z")
> [@FiratAlkis](#): > > RequireIntegrityActivationAuthenticationLevel Is there a document or detailed how to to use this new version of plugin? Is not clear to me how to install and configure wmic server on icinga… THX ---
**Author:** ![bisontim](https://community.icinga.com/letter_avatar_proxy/v4/letter/b/f17d59/32.png) [@bisontim](https://community.icinga.com/u/bisontim)\ **Post date:** [October 24, 2023, 12:23pm UTC](https://community.icinga.com/t/wmi-access-denied-after-that-install-windows-cumulative-update-kb5014702/10016/12 "2023-10-24T12:23:29Z")
I don’t know. But I used [https://github.com/cesbit/aiowmi/tree/main/contrib/wmic\_server](https://github.com/cesbit/aiowmi/tree/main/contrib/wmic_server) so I used last check\_wmi\_plus.pl and added a parameter ‘-u’ giving username to fit the wmic\_server