Test WMI Connectivity for Connector Service with WBEMTest

Available Languages

Download Options

PDF (1.0 MB)
View with Adobe Reader on a variety of devices
ePub (1.1 MB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (562.6 KB)
View on Kindle device or Kindle app on multiple devices

Updated:September 8, 2025

Document ID:224804

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

Test WMI Connectivity

Introduction

This document describes how to manually test WMI connectivity for Connector Service with WBEMTest.

Test WMI Connectivity

The Connector Service uses WMI in order to connect to your DCs and collect events. If the permissions for these connections are not set, you see "Access Denied" errors in your dashboard. This test must be run on the computer running the connector. These are the steps to manually test WMI connectivity:

Click Start > Run > WBEMTest > OK. This screen appears:
24075613964308
Click Connect.
Pick a DC which is experiencing the issue or which support has instructed you to run the test at. This must be a different machine than the one you are running this test on.
Type the IP you are trying to connect to in this format: \\192.168.10.1\root\cimv2. Do NOT use the hostname.

Note: Run the WBEMTest on the same machine as the connector is installed on and in this step, you are connecting to a remote DC.
Under credentials, use the OpenDNS_Connector user as well as the password.
Screen_Shot_2017-02-14_at_3.59.44_PM.png

Note: To run this test directly on a DC, use "root\cimv2" as the Namespace and blank Username and Password fields.
Click Connect.
24075613972756

Note: Note: If you see an Access Denied error, check the WMI and DCOM permissions. DCOM requires a reboot if changed. See Understand Required Permissions for the OpenDNS_Connector User.
Click Notification Query.

Paste this content inside the white text box:

SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' and TargetInstance.LogFile = 'Security' AND (TargetInstance.EventCode = 528 OR TargetInstance.EventCode = 540 OR TargetInstance.EventCode = 4624 OR TargetInstance.EventCode = 538 OR TargetInstance.EventCode = 4647 OR TargetInstance.EventCode = 4634 OR TargetInstance.EventCode = 4768 OR TargetInstance.EventCode = 4769)

Click Apply.

Note: Note: If you see an Access Denied error, ensure the Event Log Readers group can access the event logs with Use wevtutil to Check Event Log Permissions.
If everything is working properly, you see objects, as shown in this image. Otherwise, you are either missing WMI permissions or having connection issues to the remote server.
24075601961620