I'm using custom WMI sensor: SELECT ActiveSessions FROM Win32_PerfFormattedData_LocalSessionManager_TerminalServices
So far it worked instantly on 7 VMs but it failed on two.
What I did: Allow in windows firewall 3 rules for certain local IP address: Windows Management Instrumentation(WMI-In) Allowed - Inbound Rule Windows Management Instrumentation(DCOM-In) Allowed - Inbound Rule Windows Management Instrumentation(ASync-In) Allowed - Inbound Rule
And it worked like a charm but not for last VM.
I have tested WMI by using paessler WMI tester and it's the same error.
Checked out on that VM:
Permission for the user to the WMI namespace - local admin has all rights Verify WMI Impersonation Rights - local admins has all rights DCOM permission - ensured launch and activation permissions for "Everyone" user group has "Local Activation" and "Local Launch" permission. Credentials are correct. Turned off Windows Firewall completely and issue persisted.
Any help is welcome. Thank You