question

JamesPeppe-3969 avatar image
2 Votes"
JamesPeppe-3969 asked Docs-4663 answered

WMIC stopped working on Windows 10 2004

I use WMIC to pull logs from remote machines internally. After we upgraded a few machines to Windows 10 2004 it stopped working for those machines and we now getting the following error:

[wmi/wmic.c:196:main()] ERROR: Login to remote object.

NTSTATUS: NT code 0x80010111 - NT code 0x80010111

This indicates that Windows has changed something either in Samba or RPC to prevents WMIC from work. I know that WMIC is not an official Microsoft Product but wanted to know if Microsoft has published anything work arounds for this issue or if they have made any statements confirming changes to samba, RPC, or have acknowledged that WMIC no longer will work with there products?

windows-10-generalopenspecs-windows
· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Different problem, admittedly, but in case someone else runs into it, I came here because of a different type of brokenness: WinPE with powershell (and WMI) was working fine in previous version, but in one built with the v2004 ADK the /format:csv option obliterates output from wmic command.

For something like "wmic computersystem get Manufacturer", without the /format option, or with /format:list, I get correct output. But if I use /format:csv, then suddenly I get no output at all. No error, either.

Baffling defective behavior! I don't have a root cause or fix, and my only work-around is to revert to an older version of WinPE that works fine. Another difference was that it starts up in a high-dpi setting such that the command prompt takes up the entire screen, whereas all older versions did not do that at all.

These pesky little failures are what makes image deployment solutions so time-consuming

0 Votes 0 ·

Hi @JamesPeppe-3969
I would like to set your expectation about my help in this case. I will look into this issue from a protocols perspective. I'll try to find what is changed in the protocol that is giving you this error.

As far as Windows is concerned, wmic is deprecated.
I don't have this tool that you are talking about. You will have to send me traces that I need for investigation.

Please send an email to my attention to dochelp at microsoft dot com and I'll reply with the instructions on what and how to send me traces.

Regards,
Obaid Farooqi - MSFT

0 Votes 0 ·

Is there any information on how to solve this problem?

0 Votes 0 ·

Hello, I also use wmic 1.3.14, which is used for Linux machines. The same problem as yours has occurred. Has your problem been solved? Is there any solution?

0 Votes 0 ·
MotoX80 avatar image
0 Votes"
MotoX80 answered JamesPeppe-3969 commented

Do you see any logon errors in the security eventlog on the target machine?

Did you try re-running "winrm quickconfig" on the target machine?

Did you configure the firewall to log dropped packets for Domain/Private/Public? Any entries in the log?

Open a Powershell prompt on the source machine using an account that has admin access to the target machine. Do both of these commands fail with the same error? Use your machine name.

 wmic.exe /node:test10b path Win32_OperatingSystem get Caption,Version,OSArchitecture,CSName /format:table
 Get-CimInstance -ComputerName test10b Win32_OperatingSystem | select Caption, Version, OSArchitecture, CSName | Format-table  

I don't quite understand your last comments. Wmic.exe has been part of Windows for a long time and while MS may no longer be enhancing it, I would expect it to still work. If you are using some other WMIC, then you should be more specific about your environment and the commands/functions being executed.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you for the help. While WMIC.exe was built by Microsoft, I was referring to WMIC for linux machines. I see that the user is able to authenticate from the remote linux machine, but there are no errors in the eventlogs. Running WMIC.exe on the host machine works without any issues it seems to be an issue when running WMIC from a remote linux machine. As far as settings everything was working prior to the Windows 10 2004 upgrade.

0 Votes 0 ·

Where did you get this Linux version of WMIC? Who supports it?

0 Votes 0 ·

We have been using this for 3 years now and version is actually:

Version 4.0.0

Not exactly sure where we first obtained it, as it looks like I am unable to find any packages online. I know that another big company (not going to name names) pointed us in this direction as well as they use it in there software.

0 Votes 0 ·
JennyYan-MSFT avatar image
0 Votes"
JennyYan-MSFT answered JamesPeppe-3969 commented

Hi,

Are you using WMI plus plugin? If yes, kindly check below posts and reach the coresponding support.

Windows 2004 breaks WMI plus plugin
https://forum.nemslinux.com/viewtopic.php?t=741
Help Needed: wmic broken as of Windows 10 Version 2004
https://edcint.co.nz/checkwmiplus/help-needed-wmic-broken-as-of-windows-10-version-2004/



Hope this helps and please help to accept as Answer if the response is useful.

Thanks,
Jenny

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I am not using WMIplus, I am just using WMIC 1.3.14. I have also seen those posts and they don't seem to have a solution either. Thank you though.

0 Votes 0 ·
MotoX80 avatar image
0 Votes"
MotoX80 answered MotoX80 commented

Not exactly sure where we first obtained it, as it looks like I am unable to find any packages online. I know that another big company (not going to name names) pointed us in this direction as well as they use it in there software.



Then your best bet is to get this other big company to fix it if their software depends on it working. From a Microsoft point of view, you're using a 3rd party program of unknown origin and if it doesn't work, that not a MS problem.

If you can recreate the error from Windows to Windows, then you can open a case with Microsoft and get them to fix it. But you will need to be using supported Windows versions on both the client and the server. (If you recreate the error with XP or Server 2003, you're out of luck.)

If this WMIC is open source, then you might be able to fix it yourself. A search of the net indicates that 0x80010111 is an RPC header issue. On the "2004" machine trace the same WMI call from a Windows machine and the Linux machine using WireShark or Network Monitor 3.4. Then compare the traffic and see if you can find where the error occurs. Compare the good vs bad data packets and see if you can find where in the code that packet is built and modify the code to get it to work.

· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Understood, however it worked prior to the update and still works on machines that are not upgraded so to me it points that Microsoft changed something on their end. My original post was asking if Microsoft made any statements of changes they made with Samba or RPC.

I have seen many issue users have brought up on SAMBA issues as well with this latest upgrade.....

0 Votes 0 ·

Maybe @JennyYan-MSFT can answer that.

I found some documentation updates, but I don't know how an August/October doc change relates to version 2004. Or which one of these changes might cause your problems. Or if it's at all related.

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-winprotlp/e168a474-7de2-421c-b460-91adf87692a3

I also found this: https://wccftech.com/windows-10-version-2004-build-19041-207-kb4550936-is-out/

Windows 10 v2004 Build 19041.207 (KB4550936) is now available for Windows Insiders in the Slow ring. Today's cumulative update brings several quality improvements, including: We fixed an issue that causes the Remote Procedure Call (RPC) service (rpcss.exe) to close unexpectedly and the device stops working

It could be that a "Quality improvement" closed some hole that the WMIC developers were unknowingly invoking.

Sorry.
l


0 Votes 0 ·

Thanks! I will check to see if the patch fixes the issue.

0 Votes 0 ·
Show more comments
HungChunYu-3579 avatar image
0 Votes"
HungChunYu-3579 answered

Hi James

Did the patch fix your problem? If not you can add tag openspecs-windows to your original post, one of the Microsoft Open Specifications Support will be glad to assist you.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JamesPeppe-3969 avatar image
0 Votes"
JamesPeppe-3969 answered mikhailtsirkov-0512 published

Hi Hung,

The patch did not fix the issue.

· 5
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HI James

Thank you for the update, one of Microsoft Open Specifications Support will be contacting you shortly.

0 Votes 0 ·

Did anyone figure out what caused this issue?

3 Votes 3 ·

Hi @MicahVanMaanen-7692
I asked the original poster ( @JamesPeppe-3969 ) to send me email but I never received one. We need traces to figure out what is wrong. See my post above on Feb 4.

Regards,
Obaid Farooqi - MSFT

0 Votes 0 ·
Show more comments

Is there any information on how to solve this problem?

0 Votes 0 ·
JeffMcCashland-5087 avatar image
1 Vote"
JeffMcCashland-5087 answered

We have investigated the problem with the WMIC tool. An issue has been identified with the 2004 release of Windows 10 that impacts DCOM versions 5.1 through 5.6. The issue is being addressed for a future Windows release.

The tool is using DCOM 5.1, which is considerably aged. DCOM 5.4 was used by Windows 95 & 98, DCOM 5.6 was used by Windows 2000, but Windows has used DCOM 5.7 since Windows XP.

Updating the tool to use DCOM 5.7 or a more modern transport such as HTTP would resolve the issue. Otherwise, it should work once the issue above has been fixed.

Best Regards,
Jeff McCashland
Microsoft Open Specifications

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BenB-8975 avatar image
0 Votes"
BenB-8975 answered BenB-8975 published

Hello Jeff, do you have an ETA for the future Windows release that will address the WMIC issue?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JeffMcCashland-5087 avatar image
0 Votes"
JeffMcCashland-5087 answered

We do not have an ETA yet.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BenB-8975 avatar image
0 Votes"
BenB-8975 answered

Any update on a fix for this issue?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JeffMcCashland-5087 avatar image
0 Votes"
JeffMcCashland-5087 answered

This fix will be in a future release of Windows. There is no ETA on when this will be released.

If there is a more immediate business need, a request can be made by submitting a support case through:

Microsoft Support for Business
https://support.serviceshub.microsoft.com/supportforbusiness/

Please reference this thread if you submit a request.

Best Regards,
Jeff McCashland
Microsoft Open Specifications

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.