CSA causing WMI issues?

We are using Cisco Security Agent 5.1.0.79. We have 491 clients, mostly Win XP.
We have noticed that within 3 days of CSA installation on a PC, WMI quits working. If you try to connect to a PC using wmimgmt.msc, you get the message: "Failed to connect to (PC name) because <Null>: No such interface supported.
If we reset Windows security using the command: "secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose" The problem is fixed, at least temporarily.
About 45-50% of our PCs are affected.
This is a big deal for us because we use SMS for automated patching and inventory of PCs, and SMS relies heavily on WMI.
The only fix seems to be to remove CSA. Putting the host in Test Mode, or turning off security don't seem to make a difference.
Nothing that we see in the MC event log seems to be connected to the problem.
Has anyone else seen this?

Thanks for your response. This issue is puzzling because the problem (WMI becoming non functional) happens even when the host is in Test Mode, or when security is set to off.
We have done some tuning to allow SMS to do inventory, install patches etc... It's mostly working, although our servers outside the DMZ are still having a few issues.
We have checked for rules not logging and haven't found that to be the issue yet.
All hosts are in a normal state when this happens. We have very few hosts that go into rootkit. It's always a false alarm when they do. That's another story...
I'm having some luck with the fix for an old bug. Evidently to fix a buffer overflow exploit, Cisco previously recommended disabling csauser.dll.
That appears to be working on some of my test boxes. Unfortunately, disabling the network shim also works some of the time.
We don't have a real clear answer yet.
Tim

Similar Messages

  • WMI issues in VMware based Machine Windows 2008 R2 Servers affecting SCCM Clients

    Dear
    Brothers,<o:p></o:p>
    I came to
    an observation particularly in dealing with Windows 2008R2 Servers Vmware Based
    Virtual Machines with SCCM Clients.<o:p></o:p>
    Observation:<o:p></o:p>
    1. Windows
    2008R2 Virtual Machine with Vmware Tools installed (Also depending in the
    entries of WMI, I supposed). <o:p></o:p>
    When the SCCM Server Pushes the client on this Servers, I found out that the SCCM Client
    seems to be installed perfectly but when I tried to perform a remote WMI Query
    and the response is displayed below (The RPC Server is unavailable).<o:p></o:p>
    Now, I know that this kind of issues is something to do about DCOM Configuration
    for Remote Access right?
    Well, sad to say the settings has been checked, trippled checked actually to make sure it is correct with the correct permissions required and proven correct up to the last settings.
    I even compare the settings to those in some Windows Servers with Working WMI Remote Access.
    =========
    What I have observed is that when we make a VMware Systems and install the
    VMware Tools (see picture below) first before installing the
    SCCM Client and the issue regarding WMI Remote access issues happens (The RPC Server is unavailable).
    I proved it by creating a new VM Machine, then conduct installation in this order
    SCCM Client first and then the
    VMware Tools by this way so far the WMI Remote access works perfectly.
    Now the Question:
    Since we have atleast 70 VM Servers in production with this issue, and I proven that the VMware Tools is something to do with this issue, somehow now I need to resolved this in a logical manner.
    For some of us who can guide me to resolved the issue without uninstalling the VMware Tools and fixing the WMI settings and let the SCCM Client work.
    Regards,

    We also have this issue. Nearly all of our terminal servers. I have to run a script to fix the issue and then reboot. It works, but only for a few days and then it starts all over again...
    ::to fix "not found" wmi error
    ::to fix .net calls to wmi repository
    ::to fix "initialization failure" error
    net stop winmgmt
    c:
    cd c:\windows\system32\wbem
    rd /S /Q repository
    regsvr32 /s %systemroot%\system32\scecli.dll
    regsvr32 /s %systemroot%\system32\userenv.dll
    mofcomp cimwin32.mof
    mofcomp cimwin32.mfl
    mofcomp rsop.mof
    mofcomp rsop.mfl
    for /f %%s in ('dir /b /s *.dll') do regsvr32 /s %%s
    for /f %%s in ('dir /b *.mof') do mofcomp %%s
    for /f %%s in ('dir /b *.mfl') do mofcomp %%s
    mofcomp exwmi.mof
    mofcomp -n:root\cimv2\applications\exchange wbemcons.mof
    mofcomp -n:root\cimv2\applications\exchange smtpcons.mof
    mofcomp exmgmt.mof
    For the Update on this case Microsoft didn't find out direct connection of WMI issue to any contributors, however the clients
    from Microsoft and and 3rd party application such as VMware is highly dependent on WMI for its total function.
    Things that we have learned:
    1. Your script is the primary solution as recommended as well by Microsoft, but this is to restore the WMI to its healthy State.
    Is the error gone?
    no definitely not.
       Note: The WMIDiagnostic tool does not help to isolate at all, not even Microsoft is validating the credibility of its generated Logs from this tool.
    2. You need to apply the Hotfixes recommended by Microsoft to eliminate the WMI repository to increase its capacity which contributes to the Service to stall. Deliver the Patches via SCCM or any means of your patch deployment.
    3. Don't forget to reboot the Affected Server every Hotfix installation, this seems fix the issue. For 3 months now the usual system who got the WMI issue most of the time is no longer encountering the WMI errors. So far this is the solution, what causes
    the issue? according to Microsoft the cause is the absence of the patches.

  • Error message is not telling which field causing the issue!

    Hello
    I am developing the Adobe Interactive Form and launching this form from WebDynPro ABAP application, fine.
    This form has tonns of dropdown fields, mandatory fields, greyed out fields. Fine.
    I am filling the list the drop-down fields from webdynpro ABAP, but, i am filling list for only 80% of the drop-down fields, rest 20 % is not filling at all (bcz, business want to have those 20% dropd-owns on the form by thinking going further they require, this moment they dont need so they dont want to fill the lists)
    Now the form is launching on the browser, fine. But when user submits it i am getting the below erro:
    The Entered Value Is Not on the List of Valid Values.  (I am guessing this error is talking about the DROPDOWN fields only)
    I hv tonns of drop-down fields, so, its very difficult for me to go and trace each and every drop-down fielld!! But, i checked all the populated/entered values in the drop-down fields, they are all fine. Sone dropd-down fields are GREYED OUT, they are defaulted from webdynpro ABAP
    Pls. let me know How can know which field/drop-down is causing this issue? Wht are the possible causes for this error? Error is not telling which fields is making issue?
    How can i trace and how can i fix it, pls. let me know
    Thank you

    Thank you for your tips.
    But, as of my knowledge every thing (case sensitive, list box entries) are fine, not sure, why am getting this error! I will double chk again.
    But, thing is.... actually, i have 4 pages, depending on the logged in user, i will HIDE the pages (say, for me the 3 rd page will be hidden), i am hiding the pages by using JavaScript in the form.
    So, this error is not coming if i execute/launch all the 4 pages, but, its coming if i hide any page for any user!!
    By chance, do we debug to figure out which FIELD is CAUSING issue/this error?
    From where this message is coming, i mean, from the SAP's JAVA stack? Wht is the message ID and #?
    or is it Adobe's/Form's error?
    Thank you

  • My macbook pro keeps freezing and shutting off when I am browsing the web on Safari.  How can I figure out what is causing this issue?

    For the past few weeks my computer will slow down when I have been on Safari for awhile, then freeze, and then just go black.  I have to press the power button and then it goes to a black screen with the apple logo and a loading bar underneath when it reboots.  I'm not sure what is causing the issue, but on my previous mac it would have an error message if something like this happened that I could submit.  Any suggestions of where to start to solve this issue?
    Thanks!

    These instructions must be carried out as an administrator. If you have only one user account, you are the administrator.
    Launch the Console application in any of the following ways:
    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
    ☞ Open LaunchPad. Click Utilities, then Console in the icon grid.
    Step 1
    For this step, the title of the Console window should be All Messages. If it isn't, select
              SYSTEM LOG QUERIES ▹ All Messages
    from the log list on the left. If you don't see that list, select
              View ▹ Show Log List
    from the menu bar at the top of the screen.
    In the top right corner of the Console window, there's a search box labeled Filter. Initially the words "String Matching" are shown in that box. Enter "BOOT_TIME" (without the quotes.)
    Each message in the log begins with the date and time when it was entered. Select the BOOT_TIME log message that corresponds to the last boot time when you had the problem. Now clear the search box to reveal all messages. Select the ones logged before the boot, during the time something abnormal was happening. Copy them to the Clipboard by pressing the key combination command-C. Paste into a reply to this message by pressing command-V.
    For example, if the system was unresponsive or was failing to shut down for three minutes before you forced a restart, post the messages timestamped within three minutes before the boot time, not after. Please include the BOOT_TIME message at the end of the log extract—not at the beginning.
    If there are long runs of repeated messages, please post only one example of each. Don’t post many repetitions of the same message.
    When posting a log extract, be selective. A few dozen lines are almost always more than enough.
    Some private information, such as your name, may appear in the log. Anonymize before posting.
    Please don't indiscriminately dump thousands of lines from the log into this discussion.
    Please don't post screenshots of log messages—post the text.
    Step 2
    In the Console window, select
              DIAGNOSTIC AND USAGE INFORMATION ▹ System Diagnostic Reports
    (not Diagnostic and Usage Messages) from the log list on the left. If you don't see that list, select
              View ▹ Show Log List
    from the menu bar.
    There is a disclosure triangle to the left of the list item. If the triangle is pointing to the right, click it so that it points down. You'll see a list of reports. A crash report has a name that begins with the name of the crashed process and ends in ".crash". A panic report has a name that begins with "Kernel" and ends in ".panic". A shutdown stall report has a name that ends in ".shutdownstall". Select the most recent of each, if any. The contents of the report will appear on the right. Use copy and paste to post the entire contents—the text, not a screenshot. It's possible that none of these reports exists.
    I know the report is long, maybe several hundred lines. Please post all of it anyway.
    If you don't see any reports listed, but you know there was a crash or panic, you may have chosen Diagnostic and Usage Messages from the log list. Choose DIAGNOSTIC AND USAGE INFORMATION instead.
    In the interest of privacy, I suggest that, before posting, you edit out the “Anonymous UUID,” a long string of letters, numbers, and dashes in the header of the report, if it’s present (it may not be.)
    Please don’t post other kinds of diagnostic report—they're very long and rarely helpful.

  • Could the replacement of a fan on a graphics card cause OS issues?

    [Dangit - I unintentionally posted this in the iMac forum first - meant to post it here]
    OK I suppose it's a bonafide long shot that my replacing of an intermittently malfunctioning fan on a graphics card could cause OS issues, but I've had something immediately crop up after the replacement (crippling issues with Logic's 32-bit audio unit bridge), and they effect older projects that were previously stable, so I figured I'd ask for the heckuvit.
    Repairing permissions hasn't helped - I'm just starting to ponder whether to reset PRAM, reset SMC, boot from an HD clone, try reinstalling the old fan, etc., in order to figure out the problem....
    BTW - the graphics card is an Nvidia GT120.

    Go out and buy an Apple ATI 5770.
    What requirements does Logic have for video, and are you still on 10.6.8?
    The GT120 is 512MB but low-end card.
    If you do need more performance:
    SHOOTOUT WITH THE 'SHARKS': Sapphire Radeon HD 7950 for Mac versus really fast alternate GPUs

  • Could simply replacing a fan on a graphics card cause OS issues?

    OK I suppose it's a bonafide long shot that my replacing of an intermittently malfunctioning fan on a graphics card could cause OS issues, but I've had something immediately crop up after the replacement (crippling issues with Logic's 32-bit audio uinit bridge), and they effect older projects that were previously stable, so I figured I'd ask for the heckuvit.
    Repairing permissions hasn't helped - I'm just starting to ponder whether to reset PRAM, reset SMC, boot from an HD clone, try reinstalling the old fan, etc., in order to figure out the problem....
    BTW - the graphics card is an Nvidia GT120.

    Go out and buy an Apple ATI 5770.
    What requirements does Logic have for video, and are you still on 10.6.8?
    The GT120 is 512MB but low-end card.
    If you do need more performance:
    SHOOTOUT WITH THE 'SHARKS': Sapphire Radeon HD 7950 for Mac versus really fast alternate GPUs

  • CS 5.5 coexist with CS 6.0 causes FrameMaker issue - can't import SVG file!

    Due to some project demands, we installed Adobe CS back to 5.5 on a computer which has CS6.0 already installed. After the installation, everything worked in normal except one problem - we could not import SVG into FM file for all versions of FrameMaker on this computer.
    Does the coexistence of CS 5.5 and 6.0 cause this issue? Or can CS 5.5 coexist with CS6.0 on a same machine? or any other reasons? Please comments!
    Thanks in advance for your help!

    Due to some project demands, we installed Adobe CS back to 5.5 on a computer which has CS6.0 already installed. After the installation, everything worked in normal except one problem - we could not import SVG into FM file for all versions of FrameMaker on this computer.
    Does the coexistence of CS 5.5 and 6.0 cause this issue? Or can CS 5.5 coexist with CS6.0 on a same machine? or any other reasons? Please comments!
    Thanks in advance for your help!

  • Two Fx 4 windows open at the same time causes usability issues

    When I load two instances of Firefox, I get multiple issues with the second instance usability, display, and hot keys.
    The issues are as follows:
    # Menubar/Toolbar appear differently
    # Back/Forward buttons do not work
    # F-Keys no longer Function
    # Favicons show old, cached icons
    Please see screen grab of my two monitors with two instances of Fx 4 open, but the I played with my toolbar settings to get it to look somewhat ok.
    http://www.travellingwebguy.com/images/Fx-4.png
    This is what happens when I open a second window, and do not mess with the toolbars:
    http://www.travellingwebguy.com/images/Fx-4-2nd-window.png
    This issue was not happening with Fx 3.x.x.
    I am using a custom Persona, but I have changed the Persona a few times and I still get the same result.
    I've removed all incompatible extensions and upgraded all the ones that needed upgrading.
    Not sure what the issue is here, but would love to troubleshoot it down if possible. Please let me know if any other info is required!
    Cheers
    Tim

    Exact same issue here. Also, the add-on manger will not launch.
    I thought it might be an add-on causing these issues, but only one out of my ten or so addons work in FF4, and I disabled it with no success.
    This is a huge issue for me. I attempted to uninstall FF4 and go back to FF3 but I can't find an install file for FF3.

  • XFi-2- Latest firmware (1.20.08) has caused some issues on 32GB model...

    HXFi-2- Latest firmware (.20.08) has caused some issues on 32GB model... When I started my PC last night, it notified me that new firmware was avaliable so it downloaded it and installed it on my Xfi-2 32GB
    According to the release notes, it was to add support for the 64 GB model as well as some general improvements.
    I can't determine what the latest improvements were (anyone have any clues ) and the UI seems the same.....the only things that have changed are that my applications no longer work (when I go into the applications shortcut, it says there is no valid content: I haven't touched these folders etc and they are still populated with the three standard apps as far as I can tell)
    The other thing (which may not be related to the firmware upgrade) is that my photos shortcut now pulls up some of my music folders that contain album art. Is this a feature or a bug (I don't want it to happen, I just want it to show photos within the 'photos' folder on the device).... I think it may have been caused by me simply dragging and dropping music folders onto the device using windows explorer rather than going through Centrale (slow!)
    Cheers

    Hi Timmo.
    What release notes are you reading? I have seen no reference to improvements other than adding support for the new 64 GB model on this firmware version. From the description of the problems you have, it seems that your player has some sort of file system corruption on the internal flash. I would suggest reinstalling the firmware on your device after formatting it (formatting the device only should be enough, I think).
    The size of the new firmware release, double than the size on the previous one, means that it probably has new features and applications that will be enabled on the future; however I doubt it means it has new features right now and hope it does not means we have two firmwares (on for the 64 GB model and other for the previous ones) as the SRM/AlphaBIOS pair on the Digital Alpha systems (an ugly hack on these superb computers, in my humble opinion) -- by the way, the new firmware does not require more space on the internal flash (I have 5077 MB available on mine with all firmware releases).
    The behavior you describe about album art being shown on the photos shortcut happens with older firmware releases too; I prefer album art embedded on the audio files instead of being available as another file. I agree with you, only pictures under the photos directory should be shown as images.
    Cheers.

  • How do we change itune and icloud accounts?  My wife and I have seperate accounts but she cannot access hes, only mine.  This causes many issues like facetime, text etc. Do we have to reset her devices and start fresh?

    How do we change itune and icloud accounts?  My wife and I have separate accounts but she cannot access hes, only mine.  This causes many issues like face time, text etc. Do we have to reset her devices and start fresh?

    I think this may be the answer.
    http://support.apple.com/kb/HT5621

  • Ea6300 causing network issues when connecting to web browser on my Mac

    I have had my ea6300 for two months and its causing major issues when connecting to my web broweser before I throw it out the window can someone give me some help.

    Hi bigtimer30, what do you mean by “it’s causing major issues when connecting to my web browser”? Do you mean that the MAC computer is no longer able to access the internet? If yes, is it with both wired and wireless connections? Is this happening to all of your devices? Or just that specific MAC computer? If all the other devices are still able to connect except the MAC, I suggest that you do a power cycle on the computer (if you haven’t done it yet). And you’re having difficulties with the wireless part, try to hard wire the computer straight to your router, and check if you experience the same thing. If the wired connection is okay, you may try playing with the router’s wireless channel. Better if you could give more details for us to give you more suggestions. 

  • HT4009 I keep getting a message to contact itunes support when I try to make an in app purchase.  What could be causing this issue?  My credit card is up to date and in app purchases aren't restricted.

    I keep getting a message to contact itunes support when I try to make an in app purchase.  What could be causing this issue?  My credit card is up to date and in app purchases aren't restricted.

    Have you tried contacting iTunes Support and asking them ? We are fellow users here on these forums, it could be due to a number of reasons, we won't know which one.
    http://www.apple.com/support/itunes/contact/ - click on Contact iTunes Store Support on the right-hand side of the page, then Purchases, Billing & Redemption

  • Looking collection query for WMI Issue and obsolete computer list

    Hi 
    I want to create collection based on client having below issue.
    WMI Issue and obsolete 
    in one query.
    Kindly paste it

    hi Gokul,
    If you install the client status reporting tool on your environment its easy to find out the client health issues with a report and  for the obsolete entry query
    Client status reporting tool use http://technet.microsoft.com/en-us/library/cc161853.aspx
    http://rajsavi.wordpress.com/2012/08/20/installation-and-configuration-of-client-status-reporting-tool-for-sccm/
    WQL for duplicate entry:
    http://eskonr.com/2012/10/sccm-collectionreport-duplicate-computer-names-with-different-resource-id/
    Kamala kannan.c| Please remember to click “Mark as Answer” or Vote as Helpful if its helpful for you. |Disclaimer: This posting is provided with no warranties and confers no rights

  • New Apple ID email has caused sync issues between iPad and iPhone

    I changed the email of my Apple ID and made sure to save photos and delete old iCloud backups. The calendar noon get syncs but instead eats any new events. Photos from my iPad appear on my iphone but it doesn't work the other way around. Instead my iPad still has an iCloud photo album from my previous Apple ID email. I've made sure that my email is updated on both devices and that everything syncs to iCloud and has been recently backed up. I even deleted the new backups and did it again. I turned off photo steam and turned it back on. Any help would be greatly appreciated. One more detail, even in iTunes, I do not have photo albums being synced from my computer. I just have photo stream with iCloud.

    I'm not sure what caused the issues but backing everything up and restoring both devices has fixed photo stream as well as notes/calendar icloud issues. It even syncs to my computer again! The icloud photo album from the old apple id email is also gone.

  • WILL BIG INDEX WILL CAUSE PERFORMANCE ISSUE?

    In an index table, if there are a lot of insert then data will grow and/or if the index is
    huge then can it really cause performance issue?
    Is there a document in metalink that says if index is 50% of data then we have to rebuild it? What are the basis and threshold of rebuilding index?

    A big index by itself won't cause a performance issue. There are other circumstances you should consider for the index.
    First of all, which kind of index are you talking about, there are several kind of indexes in Oracle. On the other hand, assuming you are talking about a regular B*Tree index, you should consider factors such as selectivity and cardinality. If the indexed column has evenly distributed values, then the index will be highly selective, and if the indexed column is highly skewed, in order for the index not to become a real bottleneck you should gather histograms, so selectivity can be calculated at execution time and in case the query retrieves a highly selective data range the index won't slow performance, otherwise a full table scan will be considered a best data access path.
    Rebuilding indexes is an operation performed when the index becomes invalid, or when migrating the index to a new tablespace, but not when you suspect the index has become 'fragmented' in this case you should use the Coalesce command. Oracle provides efficient algorithms to maintain the index balanced.
    ~ Madrid
    http://hrivera99.blogspot.com/

Maybe you are looking for

  • How do i use MIB-2 for writing MIB for my application?

    I want to use the existing MIB-2 to write MIB variable for my application. The application is energy metering.So How do i use MIB-2 for writing MIBs for my application? Santosh Chavan IIT MADRAS.

  • APERTURE PHOTO BOOK WORKFLOW

    I'm new to Aperture (1.1) and am looking for advice on the best workflow to create Apple Photo Books. Issues include: 1. Getting the correct version of the photo into the book 2. Copying the photos in correct order with a single copy/drag command 3.

  • Payment Media work bench   GB_BACS

    Hi , My client wants to use the Payment method "E" that is GB_BCAS. please let me know the procedure to create payment media worbench by using GB_BACS. If you have any documentation, please send the same to my mail id: [email protected] Thanks in Adv

  • Re:name change (profit centre)

    Morning gurus, If i want to change the name of a particular profit centre what things should i check so that the change of the name will not effect anything or can i change it directly

  • Dynamically created traverse image

    Hello, I was given the task of recreating this report that our software vendor hard-coded into our system.  In it there are simple floor plan images created dynamically from a traverse string, which may look like the following: BAS2003=N42E14S11E12 F