Check Process cannot retrieve process list.

djmumbles · Post by **djmumbles** » Mon Jun 02, 2003 10:14 pm

I have had a problem whereby i set up a test to check a process is running on a remote machine whithin a WAN environment. I have specified the IP address and have used local user credentials to gain access. This worked ok and i was able to get a list of processes and successfully check the process of a remote machine... But now the test can no longer check the process, its always giving a status of unknown. When i try and list the processes in the test, it errors out saying 'can not retreive process list'?? Is this a network time out issue. Its definately not secuirty related as the test WAS working. This has happended on a couple of tests that test for a process. I have also tried using domain user login credentials.

KS-Soft · Post by **KS-Soft** » Tue Jun 03, 2003 12:07 pm

Please check following parameters:
- Remote Registry service started on remote system
- account that you use has access to
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionPerflib registry key on remote system. In order for to query performance data, account must have KEY_READ access to the above registry key. To change permissions to the registry key you can use the registry editor utility (Regedt32.exe).
By default only administrators have access.
- If HostMonitor started as service, check account that specified on Service page in the Options dialog.

Regards
Alex

djmumbles · Post by **djmumbles** » Tue Jun 03, 2003 8:16 pm

- Remote Registry service started on remote system

I have checked this service is running, and it was OK. I then restarted the service and tried again, with no luck.

- account that you use has access to
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionPerflib registry key on remote system. In order for to query performance data, account must have KEY_READ access to the above registry key. To change permissions to the registry key you can use the registry editor utility (Regedt32.exe).
By default only administrators have access.

I was using the local Administrator account, i also tried a domain Administrator without any luck. Using the local Administrator credentials had worked ok for about 1.5 weeks, untill i could not retreive a service list at all.

- If HostMonitor started as service, check account that specified on Service page in the Options dialog.

HostMonitor is not started as a service.

Its as if HostMonitor is no longer trying to connect to the server, as i get the error message almost immediately (within 1 second), usually when the server is down it takes much longer to timeout. I still have one of the tests working ok.

TIA.

KS-Soft · Post by **KS-Soft** » Tue Jun 03, 2003 9:24 pm

Did you try to restart the system? BTW What about another tests (like CPU Usage, Performance Counter)? It works?

Regards
Alex

KS-Soft · Post by **KS-Soft** » Tue Jun 03, 2003 9:42 pm

BTW: Do you have just one domain? Or HostMonitor's system located in one domain and monitored system in another?

Regards
Alex

djmumbles · Post by **djmumbles** » Wed Jun 04, 2003 9:25 pm

I have asked the administrator about the last time a reboot occured on these machines.

One machine was recently rebooted. I have now re-run the test and it seems to be working fine again!!

This is meant to be done regularly but apparently this has not been happening.

Thanks a lot for your time.

If i find i still can't run the other tests after rebooting the other servers i will leave another post. But this definately could have been the problem.

Thanks again.

hmonnetworks · Post by **hmonnetworks** » Sat Jul 05, 2003 5:33 pm

I have recently been having the same problem. The problem started after doing two things: (1) removing the old "cheap" hubs that the HostMonitor server is running on and (2) installing W2K SP4. I'm not sure which. If anyone has any insight on this, I'd much appreciate it.

Generally, rebooting the remote machine doesn't help, but rebooting the HostMonitor server does.

Marcus · Post by **Marcus** » Mon Jul 07, 2003 2:50 am

SP4 does add a new security setting for 'impersonation'. It could be HM has not the right permissions to connect as a different user.

Default only administrators and the system account have this permission.

<font size=-1>[ This Message was edited by: Marcus on 2003-07-07 02:51 ]</font>

djmumbles · Post by **djmumbles** » Thu Jul 10, 2003 2:04 am

I'll try the SP4. I don't have these problems if i set up my local Administrator account with the same password as the remote machine, on my Hostmonitor machine. Login locally as Administrator, all works fine.

However if i log into the DOMAIN admin, which is where the machine usually logs into, then i have this problem. Even if i specify to connect as Local User, and Local password.

Could be impersentation problem, as this is what needs to happen when this error is occuring, let ya know if it fixes the problem. Thanks.

Marcus · Post by **Marcus** » Thu Jul 10, 2003 3:12 pm

This is a windows thing combined with HM. If you use a different user, HM will not allow you to specify a domain (<domain><user>. Well it does, but it doesn't use it as a domain).

This means you log on to the remote machine with <workstation><username> (when logging on locally with a local account) or <domain><username> (when logging on locally with a domain account).

The trick is that if the remote machine is not in the same domain, it can not validate the <domain><user> account. But if it receives a <workstation><user> account, it wil not validate against a domain controller, but against its local sam database.

So you should create a local account on the remote machine, with the same credentials as the HM machine. Assuming the machines are in different domains (or stand-alone).

<font size=-1>[ This Message was edited by: Marcus on 2003-07-10 15:15 ]</font>

djmumbles · Post by **djmumbles** » Thu Jul 10, 2003 6:37 pm

I have tried the above recomendations.

I installed SP4, and rebooted, and still had no luck.

=====
So you should create a local account on the remote machine, with the same credentials as the HM machine. Assuming the machines are in different domains (or stand-alone).
=====

I have done the above, and this only works when i log the HM machine as a local account. Unfortunately its it MUST be logged into a domain.

I have also specified connect to <workstation><username>. This still does not work, when logged into a domain on the HM machine.

Therefore the connect to facility is not really working.

I can work around the bug, now i know whats causing the problem. That is to add DOMAIN/Admin Domains to the local Administrators group of my remote machine.

I have tested this and this works ok. This actually proves that my DOMAIN credentials are being passed!! Not the specified or 'connect to' credentials.

Thanks for your suggestions.

hamoja · Post by **hamoja** » Fri Jul 11, 2003 5:34 am

NT 101. If your remote machine is limiting access only to its local resource, then any attempt to establish a remote unc session from a domain or otherwise is restricted unless you specify the full computernameusername of the remote resourse.

If your HM server is standalone (computer account is not a member of the domain) then you must connect as either:

Standalone:
"computernameusername (using remote station credentials)"

Domain:
domainusername

djmumbles · Post by **djmumbles** » Mon Jul 14, 2003 1:16 am

=====
NT 101. If your remote machine is limiting access only to its local resource, then any attempt to establish a remote unc session from a domain or otherwise is restricted unless you specify the full computernameusername of the remote resourse.
=====

I have specified the full computernameusername. It did not make any difference!!

=====
If your HM server is standalone (computer account is not a member of the domain) then you must connect as either:

Standalone:
"computernameusername (using remote station credentials)"

Domain:
domainusername
=====

The HM machine is part of the DOMAIN. I have tried both the above combinations and they do not work.

---------

The solution I have used is as follows.

The Remote machine IS NOT part of the domain. It is part of a Workgroup.

Instead of assigning it to the workgroup. I have joined the domain, but only log the machine into itself (MachineName/Username).

The end result is that, the "Domain Admins" group is added to the remote machines local "Administrators" group. This then allows HM to look up the resources with rights required.

The connect to: facility should really let me specify <LOCAL MACHINE>/<USER NAME>. If this worked i could leave the remote machines members of a work group. It just so happens that there is no real reason that these machines need to be member of a workgroup....