000017436 - Windows Legacy Collector cannot connect to Windows event sources in RSA NetWitness Platform

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Sep 26, 2019
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000017436
Applies ToRSA Product Set: NetWitness Logs & Network, Security Analytics
RSA Product/Service Type: Windows Legacy Collector
RSA Version/Condition: 10.6.x
IssueWindows Legacy Collector (WLC) cannot connect to Windows event sources in RSA NetWitness.

Errors are found in the Windows Legacy Collector logs in the format:  Could not connect to server '\\<IP>\ROOT\CIMV2': error code: 80070005: Access is denied.

For example,

 

[windows.win2003] [processing] [WorkUnit] [processing] Could not connect to server '\\win2003.local.net\ROOT\CIMV2': error code: 80070005: Access is denied.


 
CauseThis issue is caused because the NetWitness Log Collector is unable to connect to the remote machine using WMI.
These errors are likely because of permissions or policy.
Resolution

Verify the account permissions on the Windows event source that it allows WMI calls is configured per the Legacy Windows Collection
Update & Installation Guide
.

WMI access from the Windows Legacy Collector server to a remote machine can be tested from the DOS command line using the wmic command.

For example, run over WMI the wmic command to display the remote machine's operating system name.

wmic /node:{IP} /user:{User} os get caption

Substitute

{IP} with the IP address of the remote machine the Windows Legacy Collector server will connect to
{User} with the login that connects to the remote machine (the same login the Log Collector service is configured with)

For example,
 




C:\Users\Administrator>wmic /node:192.168.1.2 /user:sauser os get caption
Enter the password :********

Caption
Microsoft Windows Server 2003 R2 Standard

 

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

Legacy Article IDa65143

Attachments

    Outcomes