4

Problem

In Powershell after executing the following command ...

Get-WmiObject Win32_ComputerSystem -Credential second.nl\administrator -ComputerName srv02.second.nl

... the following exception is thrown ...

Get-WmiObject : A security package specific error occurred. (Exception from HRESULT: 0x80070721)
At line:1 char:1
+ Get-WmiObject Win32_ComputerSystem -Credential second.nl\administrator -ComputerNa ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], COMException
    + FullyQualifiedErrorId : GetWMICOMException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

Scenario

  • Server srv01 in AD domain first.nl
  • Server srv02 in AD domain second.nl

When srv01 executes the command mentioned earlier. It results in the exception 80070721.

Workaround

Appending the DNS suffix (second.nl used by srv02) in the Advanced TCP/IP Settings on svr01 resolves this problem.

Advanced TCP/IP Settings

Question(s)

  • Why does the WMI query work when appending the DNS suffix second.nl to srv01?
7
  • You might check GPEDIT.msc settings of Local Computer Policy -> Windows Settings -> Security Settings -> Local Policies -> Security Options, and then ensure the Network security: LAN Manager authentication level is set to Send NTLMv2 response only. If that works, let me know and I'll post as an answer with the source I found it. Dec 5, 2015 at 4:49
  • Thanks for your comment. This setting should happen on de requesting server I suppose? Dec 5, 2015 at 7:20
  • Yes, I believe it'd be set on the requesting server so on mp01.publiek.lan see if that's what it is set to. Dec 5, 2015 at 14:18
  • The requesting server is the one executing the WMI query (requesting) for information from the target server. But I will definitely give your information a go tomorrow. I'll report back asap. Updated the questions code so it matches the information (hostnames/domain names) form the example. Dec 6, 2015 at 10:07
  • 1
    Here's a small read on the topic (technet.microsoft.com/en-us/library/jj852207.aspx), I think the client and the server (or requesting and target) just need to agree on what to use algorithm wise. I would think the server you're getting the information from is where you'd want to check but perhaps check both. This should be something simple enough to eliminate as the cause at least so I'm not 100% certain that's the case so just suggesting to give it a check in case it is. Dec 6, 2015 at 10:28

0

You must log in to answer this question.

Browse other questions tagged .