Today we're going to take a look at an issue that is fairly common when dealing with WMI failures. Starting with Windows XP, WMI providers are hosted in a separate process called WMIPRVSE. Most of the time this provider host runs in the context of the Network Service Account. In order to properly function, this account must have the rights to impersonate a client after authentication.
By default in Windows XP SP2 and Windows Server 2003, the Network Service account which resides within the SERVICE group has impersonation rights. However, there have been more than a few occasions where we have worked with customers who found out that this right had been removed. More often than not, the removal was due to an older group policy that was in place that did not include the Network Service account within the list of accounts / groups granted the Impersonate right.
|