Latest windows update (June 2022) errors check wmi

[trentasis]

Hi,

Seems that since windows 2012 is updated to latest updates (with june 2022 updates) check wmi fails: error is:

UNKNOWN – The WMI query had problems. You might have your username/password wrong or the user’s access level is too low. Wmic error text on the next line.

We are using latest wmic recompiled one year ago to sovle similar issues with windows 10, anybody has detected this issue?

Can be solved or exist any workaround?

Thanks

[trentasis]

seems that is the issue, possible workaround
https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

Registry setting to enable or disable the hardening changes
During the timeline phases in which you can enable or disable the hardening changes for CVE-2021-26414, you can use the following registry key:

Path : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat

Value Name: “RequireIntegrityActivationAuthenticationLevel”

Type: dword

Value Data: default = 0x00000000 means disabled. 0x00000001 means enabled. If this value is not defined, it will default to disabled.

Note You must enter Value Data in hexadecimal format.

Important You must restart your device after setting this registry key for it to take effect.

Note Enabling the registry key above will make DCOM servers enforce an Authentication-Level of RPC_C_AUTHN_LEVEL_PKT_INTEGRITY or higher for activation.

[musicalvegan0]

Instead of softening the server configuration, we opted for a this Python WMI client: https://github.com/dlundgren/py-wmi-client

It can be installed via pip and is a drop-in replacement for the typical wmic binary:

pip2 install wmic

It’s also a better long term solution than softening the server configuration as the softening option will eventually go away all together and we’ll be forced to use a more secure client.

Fair warning: this Python WMI Client is not as performant as the wmic binary. We noticed a pretty big spike in CPU load on our Nagios server as a result, but it appears that much of that load is on CPU wait-time.

[trentasis]

Thanks I’ll try to install this version and check if this issue is solved

This version is this new versions described here https://edcint.co.nz/checkwmiplus/new-wmic-client-coming-soon/ ?

thanks

[musicalvegan0]

I don’t think that’s the new Check WMI Plus version. py-wmi-client hasn’t enjoyed an update in over 5 years. The version described here seems like a much bigger rework of Check WMI Plus than just a new WMIC client.

[admin]

This new version of Check WMI Plus will fix all your issues

Version 1.67 Released

[trentasis]

Hi
Installed 1.68 version and seems correctly installed

Now I want to migrate to new wmic server but I’m not sure if we need requirements using checmi we receive

./check_wmi_plus.pl -d -d | head -n 25
Command Line (v1.68): ./check_wmi_plus.pl -d -d
Base Dir: /usr/local/nagios/libexec/check_wmi_plus_168/
Conf File Dir: /etc/check_wmi_plus
Loaded Conf File /etc/check_wmi_plus/check_wmi_plus.conf
WMI Ini Dir: /etc/check_wmi_plus/check_wmi_plus.d
======================================== SYSTEM INFO =====================================================
——————— Module Versions ———————
MODULE_NAME INSTALLED_VERSION STATUS DESIRED_VERSION
Config::IniFiles 2.83 ok 2.58
Perl Version 5.010001 ok 5.01
HTTP::Request::Common 6.04 ok 0
JSON 2.15 ok 0
Getopt::Long 2.42 ok 2.38
DateTime 1.12 ok 0.66
Number::Format 1.73 ok 1.73
LWP::UserAgent 6.06 ok 0
Data::Dumper 2.154 ok 2.125
Scalar::Util 1.41 ok 1.22
Storable 2.51 ok 2.22
Net::DNS –
——————— Environment ———————

reading doc about wmi server seems that there are 3 requirment for smic server , how can I check if are installed ?

on seems to be awio wmi but I can’t find how to install this porjecte any doc whre is detaield how to install on a centos?

thanks

[Author]

Posts