JSI Tip 10252. You receive 'Access is denied' when you query some WMI objects on a Windows Server 2003 SP1 domain controller?

Jerold Schulman

March 9, 2006

1 Min Read
ITPro Today logo in a gray background | ITPro Today

When you query some WMI (Windows Management Instrumentation) objects on a Windows Server 2003 SP1 (Service Pack 1) domain controller, you receive Access is denied. If you use the Ultrasound tool to collect information from the Windows Server 2003 SP1 DC, you receive a message similar to:

Access to the Ultrasound WMI provider is denied. You may need to redeploy the provider. Also it may be a clock skew more then 5 minutes between controller and provider machines.

New SP1 DCOM security features provide high security access based upon the new built-in Distributed COM Users group. Since all domain controllers in a domain share all the built-in groups, Windows Server 2003 SP1 only adds the new built-in group to the Windows Server 2003 SP1 PDC emulator (Primary Domain Controller).

To prevent the subject behavior, always install SP1 on the PDC first.

NOTE: See Description of the changes to DCOM security settings after you install Windows Server 2003 Service Pack 1.



Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like