Contents

Introduction

Test WMI Connectivity

Introduction

This document describes how to manually test WMI connectivity for Connector Service with WBEMTest.

Test WMI Connectivity

The Connector Service uses WMI in order to connect to your DCs and collect events. If the permissions for these connections are not set, you see "Access Denied" errors in your dashboard. This test must be run on the computer running the connector. These are the steps to manually test WMI connectivity:

1. Click Start > Run > WBEMTest > OK. This screen appears:

24075613964308

2. Click Connect.

3. Pick a DC which is experiencing the issue or which support has instructed you to run the test at. This must be a different machine than the one you are running this test on.

4. Type the IP you are trying to connect to in this format: \\192.168.10.1\root\cimv2. Do NOT use the hostname.

Note: Run the WBEMTest on the same machine as the connector is installed on and in this step, you are connecting to a remote DC.

5. Under credentials, use the OpenDNS_Connector user as well as the password.

Screen_Shot_2017-02-14_at_3.59.44_PM.png

Note: To run this test directly on a DC, use "root\cimv2" as the Namespace and blank Username and Password fields.

6. Click Connect.

24075613972756

Note: Note: If you see an Access Denied error, check the WMI and DCOM permissions. DCOM requires a reboot if changed. See Understand Required Permissions for the OpenDNS_Connector User.

7. Click Notification Query.

8. Paste this content inside the white text box:
SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' and TargetInstance.LogFile = 'Security' AND (TargetInstance.EventCode = 528 OR TargetInstance.EventCode = 540 OR TargetInstance.EventCode = 4624 OR TargetInstance.EventCode = 538 OR TargetInstance.EventCode = 4647 OR TargetInstance.EventCode = 4634 OR TargetInstance.EventCode = 4768 OR TargetInstance.EventCode = 4769)

9. Click Apply.

Note: Note: If you see an Access Denied error, ensure the Event Log Readers group can access the event logs with Use wevtutil to Check Event Log Permissions.

10. If everything is working properly, you see objects, as shown in this image. Otherwise, you are either missing WMI permissions or having connection issues to the remote server.

24075601961620