Q: My workflows from System Center Service Manager (SCSM) that communicate with System Center Configuration Manager (SCCM) are failing with a 33880 error in the Operations Manager log. What can I do?

A: If you look at the error in the event log and at the actual workflow within the Service Manager console, you'll find a more detailed error. Most likely, it will be

Microsoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlQueryException: The ConfigMgr Provider reported an error. ---> System.Management.ManagementException: Access denied
at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
at System.Management.ManagementScope.InitializeGuts(Object o)
at System.Management.ManagementScope.Initialize()
at System.Management.ManagementObjectSearcher.Initialize()
at System.Management.ManagementObjectSearcher.Get()
at Microsoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlConnectionManager.Connect(String configMgrServerPath)

This shows an access denied error, which is typically caused by either the SCSM workflow or service account not having the correct permissions in SCCM, or the DCOM permissions on the SCCM server being incorrect. The easiest way to test is to run the wbemtest utility from the SCSM server to the SCCM box running as the SCSM workflow and service accounts. If this fails and you get "access denied," then you know it's something in the SCCM or DCOM permissions you need to fix.

To ensure you have the right DCOM permissions, see this TechNet page. I found I had to remove and re-add the permissions for SMS Admins to fix the problem. Remember both your workflow and service account for SCSM should be members of the SMS Admins group on the SCCM server.

If your DCOM permissions are fine, verify the actual SCCM permissions, as described on this TechNet page.